so litchfield just posted a pdf on what he calls lateral sql injection...
basically, the attack focuses on situations where you can affect a function which doesn't take any parameters. normally you'd assume such functions were immune to attack. but he takes a side-channel approach and alters the output of internal commands called by the function which are used in sql queries.
as he says at the end of the paper, the attack vector probably isn't going to be seen all that often. i'm def not a sql/db expert, but it seems like you'd need a decent amount of knowledge about the underlying code being used in a system to attack it via lateral sql injection... of course, there are probably some really common stored procedures, and perhaps an attacker could make reasonable guesses as to what a developer called in his or her code...
anywho, it's always fun to see people looking at things in new ways...
Thursday, April 24, 2008
Tuesday, April 22, 2008
Monday, April 21, 2008
storm info
been doing some reading on a fascinating investigation into the storm worm which came out of the usenix leet08 con...
the authors start out explaining traditional botnets, and then differentiate the new p2p botnet anatomy. they do analysis on how information is routed and propagated, and then look into how they can participate within the network to gauge its size and more...
the sybil attack (and eclipse attack) are new to me, and pretty nifty...
overall, i think it is interesting how we're seeing p2p evolve to fill a new space. coming out of the high ideals of freenet, p2p moves over to a lot of legit and illegit filesharing, and now we're seeing it used to protect the C&C capabilities of modern organized crime networks.
the sophistication of some aspects of storm are quite impressive. the authors describe adaptive attacks on browsers, where non-vulnerable browsers are ignored and vulnerable ones are sent a variety of payloads. also, the exe files used to infect hosts are repacked by the minute (which seems like a cpu expensive operation) on certain web servers serving them... the payload includes a rootkit to hide itself. there are other things which point to ongoing and active development of the network. they say they are going to try to identify the ppl behind the curtain as their next effort, and i wish them luck. i am quite curious to know more about the innerworkings and motivations of the people who are coding this up.
another interesting note is that almost all of the social engineering attacks from storm were done in english. given the level of sophistication we're seeing in being adaptive and polymorphic in some areas, i wonder how long it will be until we see adaptive language (maybe based on destination ip of the domain for the spam?) as a component in these networks.
finally, the authors say they were able to successfully attack the network from the inside, by seeding benign files and then routing requests for malicious files to their sybils (the polluting attack). this is very nifty, because it allows for disruption to the network overall, and might (?) allow for the possibility to write a type of code-green countermeasure if you could somehow get infected hosts to execute a file which would turn them into sybils or clean themselves somehow.
unfortunately, given how sophisticated the bad guys seem to be, i can only imagine that this possibility will be closed in the future. i may not have thought this all the way through, but it seems that the clients could be coded to check for a digital signature on any file which is being published, and to ignore any published files which are incorrect or missing a signature. this wouldn't prevent infiltration into the network, but i think it would severely hamper any ability to hijack or suppress it. on the flip side, however, i believe the authors would then subject themselves to non-repudiation if law enforcement found a copy of the private key on their box ;)
the authors start out explaining traditional botnets, and then differentiate the new p2p botnet anatomy. they do analysis on how information is routed and propagated, and then look into how they can participate within the network to gauge its size and more...
the sybil attack (and eclipse attack) are new to me, and pretty nifty...
overall, i think it is interesting how we're seeing p2p evolve to fill a new space. coming out of the high ideals of freenet, p2p moves over to a lot of legit and illegit filesharing, and now we're seeing it used to protect the C&C capabilities of modern organized crime networks.
the sophistication of some aspects of storm are quite impressive. the authors describe adaptive attacks on browsers, where non-vulnerable browsers are ignored and vulnerable ones are sent a variety of payloads. also, the exe files used to infect hosts are repacked by the minute (which seems like a cpu expensive operation) on certain web servers serving them... the payload includes a rootkit to hide itself. there are other things which point to ongoing and active development of the network. they say they are going to try to identify the ppl behind the curtain as their next effort, and i wish them luck. i am quite curious to know more about the innerworkings and motivations of the people who are coding this up.
another interesting note is that almost all of the social engineering attacks from storm were done in english. given the level of sophistication we're seeing in being adaptive and polymorphic in some areas, i wonder how long it will be until we see adaptive language (maybe based on destination ip of the domain for the spam?) as a component in these networks.
finally, the authors say they were able to successfully attack the network from the inside, by seeding benign files and then routing requests for malicious files to their sybils (the polluting attack). this is very nifty, because it allows for disruption to the network overall, and might (?) allow for the possibility to write a type of code-green countermeasure if you could somehow get infected hosts to execute a file which would turn them into sybils or clean themselves somehow.
unfortunately, given how sophisticated the bad guys seem to be, i can only imagine that this possibility will be closed in the future. i may not have thought this all the way through, but it seems that the clients could be coded to check for a digital signature on any file which is being published, and to ignore any published files which are incorrect or missing a signature. this wouldn't prevent infiltration into the network, but i think it would severely hamper any ability to hijack or suppress it. on the flip side, however, i believe the authors would then subject themselves to non-repudiation if law enforcement found a copy of the private key on their box ;)
Wednesday, April 9, 2008
notacon
notacon! just got back... been forever since posted... anywho, just a few pics...
the con was a bunch of fun... very chilled environment. i've only been doing the bh/dc stuff before now, so this was quite a change... got to hang out w/ some friends who i don't often enough get to drink beers w/...
some interesting talks, and talked to some cool ass ppl, hung at at the lp pagoda.... oh yea, and there was a party which whupped my arse the next day...
go figure, DoD sent their best and brightest ;)
anywho i loved it... super happy i went and hope to go again next year...
oh yea, and one itty bitty security tidbit... so i left my lp stuff at home, so i bought a new set of picks at the con (which was pointless, b/c my club-like hands were seemingly cursed and useless over the weekend... sigh...). well, you know, i coulda dropped em in the thing to send em home in the mail. they say no tools over 8 inches, but i figure mb they wouldn't like lockpicks on the plane given all of the stuff they've taken from ppl in the past...
speaking of that:
so anyway, we ask the TSA lady if that's stuff they pulled out of luggage and off of people, and she's like "yep, isn't is scary what people try to get on planes? that's all stuff we got in the first year since we've been doing this" (mb she meant post 9/11 sec measures?)... so i say back, "well, i guess people were probably carrying that stuff all along, and we just didn't know"... she gives me a weird look at that point...
so i'm wondering if they're going to spot my picks as my bag goes through the xray... and i hear "bag check!"... crap... the lady pulls it out, and opens it up, and pulls out a little bottle of hot sauce my friend gave me... "it's just two ounces" she says, and gives me the bag...
sigh... i am kinda disapointed...
Wednesday, March 12, 2008
homebrew forensics
came across an interesting article about a university in australia where students (staff?) developed a linux based livecd tool called SImPLE to assist police in forensics investigations...
at first i was like, "erm, helix" but after i RTFA i realized that this is a different class of product.
they reportedly have remove hdd write capability from the kernel, and come up with some scripts which dig through the file-system looking for image and movie files. it mentions that there are skin tone algorithms as well, which sounds kinda nifty (speaking as one who hasn't done any img analysis programing)...
so anyway, you can prolly see where this is going: helping cops find child pr0n...
the jist of it is that police forensics units were overwhelmed, and many cases involved cp. i know from talking to people who used to be that type of LEO that there are definately staffing and workload constraints.
so on the surface this seems like a cool tool. basically the beat cops get a cd and drop it on the suspects laptop and take a gander at the imgs and vids the tool produces.
i guess it is dual edged because if you aren't doing a drive image and then doing helix/ftk/encase analysis, you're prolly gonna miss a lot of stuff. are there crypted containers? are there deleted files? slack space files? is there other evidence in the file-system which might lead you to find evidence elsewhere?
i dug around a bit for the tool, but couldn't find it, so mb it isn't open. i found another project the uni is doin called LIARS (Laptop Inspector and Recovery System), where it digs through registry keys to help determine information about the original owner of a lost/stolen laptop... w00t @ that!
so i guess overall it is a win, and we just get back to the old equation of balancing cost versus value. use the tool to reduce the load, but if you feel strongly that the person is a sophisticated predatory type, hire a real forensics investigator to do the job right.
we actually do a similar thing at work. we can do general investigations to help you figure out what happened, and we can also do very detailed analysis which can be used in legal proceedings and the like. we just leave it up to the client to tell us which level of detail they want....
we also use a linux derived tool (amongst others) for part of our analysis, but it's just to grab the image. this box has a ton of different ports, and is a write-blocker. you hook up the two drives and hit go, and it rips off a bit for bit image. then it is ready for loading into your fav tool...
and on a completely unrelated kick... i saw this at a client site the other day. it was just sitting in a hallway area... i couldn't help but laugh... i didn't want to know what was in the container... ;)
if you can't read it, it says "DO NOT TURN THIS VALVE"... lol...
at first i was like, "erm, helix" but after i RTFA i realized that this is a different class of product.
they reportedly have remove hdd write capability from the kernel, and come up with some scripts which dig through the file-system looking for image and movie files. it mentions that there are skin tone algorithms as well, which sounds kinda nifty (speaking as one who hasn't done any img analysis programing)...
so anyway, you can prolly see where this is going: helping cops find child pr0n...
the jist of it is that police forensics units were overwhelmed, and many cases involved cp. i know from talking to people who used to be that type of LEO that there are definately staffing and workload constraints.
so on the surface this seems like a cool tool. basically the beat cops get a cd and drop it on the suspects laptop and take a gander at the imgs and vids the tool produces.
i guess it is dual edged because if you aren't doing a drive image and then doing helix/ftk/encase analysis, you're prolly gonna miss a lot of stuff. are there crypted containers? are there deleted files? slack space files? is there other evidence in the file-system which might lead you to find evidence elsewhere?
i dug around a bit for the tool, but couldn't find it, so mb it isn't open. i found another project the uni is doin called LIARS (Laptop Inspector and Recovery System), where it digs through registry keys to help determine information about the original owner of a lost/stolen laptop... w00t @ that!
so i guess overall it is a win, and we just get back to the old equation of balancing cost versus value. use the tool to reduce the load, but if you feel strongly that the person is a sophisticated predatory type, hire a real forensics investigator to do the job right.
we actually do a similar thing at work. we can do general investigations to help you figure out what happened, and we can also do very detailed analysis which can be used in legal proceedings and the like. we just leave it up to the client to tell us which level of detail they want....
we also use a linux derived tool (amongst others) for part of our analysis, but it's just to grab the image. this box has a ton of different ports, and is a write-blocker. you hook up the two drives and hit go, and it rips off a bit for bit image. then it is ready for loading into your fav tool...
and on a completely unrelated kick... i saw this at a client site the other day. it was just sitting in a hallway area... i couldn't help but laugh... i didn't want to know what was in the container... ;)
if you can't read it, it says "DO NOT TURN THIS VALVE"... lol...
Friday, February 29, 2008
happy über-kludge day!!!
Feb 29th is possibly the longest lasting kludge in human history.... if you've got a better one, i'd love to know about it ;)
info ganked from wikipedia :D
Adding an extra day to the calendar every four years compensates for the fact that a solar year is almost 6 hours longer than 365 days ... However, some exceptions to this rule are required since the duration of a solar year is slightly less than 365.25 days. Years which are evenly divisible by 100 are not leap years, unless they are also evenly divisible by 400, in which case they are leap years For example, 1600 and 2000 were leap years, but 1700, 1800 and 1900 were not. Going forward, 2100, 2200, 2300, 2500, 2600, 2700, 2900, and 3000 will not be leap years, but 2400 and 2800 will be. By this rule, the average number of days per year will be 365 + 1/4 − 1/100 + 1/400 = 365.2425, which is 365 days, 5 hours, 49 minutes, and 12 seconds ... The marginal difference of 0.000125 days means that in around 8,000 years, the calendar will be about one day behind where it is now. But in 8,000 years, the length of the vernal equinox year will have changed by an amount which cannot be accurately predicted
info ganked from wikipedia :D
all your search results are belong to who?
ok... i think this is really important....
the ninjas over at google have been monitoring drive by malware in their search results, and they've come to find that more than 1% of their search results last month contained suspected malware... and they point out that the trend is increasing:
as expected, pr0n sites are more likely than other pages to contain malware. i obviously haven't read enough, but i wonder if google is delivering these pages or blocking them. even if they aren't delivering them, what about yahoo and others? i'd really like to know the percentage of malware sites which (would) appear on the first page...
one of the most important aspects of this shouldn't be overlooked. in many cases here we're talking about legitimate sights serving malware... we're talking about malicious adds being served, and other general badness.
this is why i run noscript and flashblock all the time. there are only a couple of domains i permanently allow. i don't allow youtube (or the new ytimg.com bs) by default, just as an example. sometimes it is a PITA, but this type of info reminds me that it is the smart thing to do. anyway, i'm getting ready to install safecache and safehistory too...
bleh...
the ninjas over at google have been monitoring drive by malware in their search results, and they've come to find that more than 1% of their search results last month contained suspected malware... and they point out that the trend is increasing:
as expected, pr0n sites are more likely than other pages to contain malware. i obviously haven't read enough, but i wonder if google is delivering these pages or blocking them. even if they aren't delivering them, what about yahoo and others? i'd really like to know the percentage of malware sites which (would) appear on the first page...
one of the most important aspects of this shouldn't be overlooked. in many cases here we're talking about legitimate sights serving malware... we're talking about malicious adds being served, and other general badness.
this is why i run noscript and flashblock all the time. there are only a couple of domains i permanently allow. i don't allow youtube (or the new ytimg.com bs) by default, just as an example. sometimes it is a PITA, but this type of info reminds me that it is the smart thing to do. anyway, i'm getting ready to install safecache and safehistory too...
bleh...
Subscribe to:
Posts (Atom)
