UIET Secure Tech | Computer Security Forum

Java Zero Day Attack

arsh — Sun, 13 Jan 2013 11:11:07 GMT

Java Under Attack

Java zero-day vulnerability is under attack by at least four active campaigns. Oracle has yet to respond. What to do?

Security experts have a message for all businesses: Disable Java now, and keep it disabled.

An exploit for a previously unknown and currently unpatched vulnerability in Java is being used by cyber-criminals to infect computers with malware, according to security researchers.

An independent malware researcher who uses the online moniker Kafeine reported the existence of the exploit "in the wild" -- being actively used in attacks -- on his blog this week.

Attackers are using such exploits to silently install malware on the computers of users who visit compromised websites, in what are known as drive-by download attacks.

The Java zero-day vulnerability, dubbed CVE-2013-0422, "allows remote attackers to execute arbitrary code via unknown vectors, possibly related to 'permissions of certain Java classes,'" according to the National Vulnerability Database.

The flaw affects all versions of Java 7, including Oracle Java 7 Update 10, which is the most recent version. With some estimates suggesting that 34% of all PCs currently run a version of Java 7, the zero-day vulnerability may now be present on over 400 million systems.

With that in mind, what's the quickest way to disable Java? On systems running recent versions of Java, the Java control panel can be used to immediately disable the plug-in for all installed browsers.

Technology giant Oracle, which maintains Java, has yet to issue an official response regarding the latest zero-day Java flaw, which suggests that a fix won't be immediately forthcoming.

Indeed, this is far from the first time that security experts have sounded warnings over Java. Last year, the discovery of a zero-day flaw in Java 7 affecting Windows, OS X, and Linux led also led to calls that Java should be immediately disabled in all browsers.

Some companies have been pursuing stronger measures. In October Apple issued an update that excised Java from all Apple browsers. To run Java, users would need to download the software from Oracle.

"We first observed the new Java 0-day on Dec 17th, very low rates until the morning of Jan 9th when detection rate surged," said Costin Raiu, a senior security researcher at Kaspersky Lab.

"The 0-day attack code that was spotted in the wild today is yet another instance of Java security vulnerabilities that stem from insecure implementation of the Java Reflection API," said Adam Gowdiak, the founder of Security Explorations, a Polish security company that specializes in Java vulnerability research.

What is a Zero-day attack?

A zero-day exploit is one that takes advantage of a security vulnerability on the same day that the vulnerability becomes generally known. There are zero days between the time the vulnerability is discovered and the first attack.

Flame - heralding a new age of CyberWar!

predator — Sun, 17 Jun 2012 09:42:13 GMT

The Flame computer virus that smoldered undetected for more than 2 years in Middle Eastern energy facilities confirmed fears that the world has entered a new age of cyber espionage and sabotage.
Internet defenders are tearing into freshly exposed Flame malware (malicious software) that could be adapted to spread to critical infrastructures in countries around the world.
While the components and tactics of Flame were considered old school, the gigantic virus's interchangeable software modules and targeted nature were evidence that malware is a potent weapon in the Internet era.
"We are seeing much more specific types of malware and attacks," said McAfee Labs director of security research David Marcus.
"When you talk about a situation where the attacker knows the victim and tailors the malware for the environment it jumps out," he said. "That speaks to good reconnaissance and an attacker who knows what they are doing."
Gathering intelligence on targets and then crafting viruses to exploit specific networks as well as the habits of people using them is certainly in vogue, Marcus said.
The Flame malware looks to be another phase in the cyber war whose effects were noticed after Stuxnet and Duqu malwares were discovered. "It's important to understand that such cyber weapons can easily be used against any country," said Eugene Kaspersky, founder of Kaspersky Lab, which uncovered Flame.
High concentrations of compromised computers were found in the Palestinian West Bank, Hungary, Iran, and Lebanon. Additional infections have been reported in Austria, Russia, Hong Kong, and the United Arab Emirates.
Compromised computers included many being used from home connections, according to security researchers who were looking into whether reports of infections in some places resulted from workers using laptops while traveling.
Flame was designed to suck information from computer networks and relay what it learned back to those controlling the virus.
Flame can record keystrokes, capture screen images, and eavesdrop using microphones built into computers and was protected by multiple layers of encryption.
In an intriguing twist, the malware can also use Bluetooth capabilities in machines to connect with smartphones or tablets, mining contact lists or other information, according to security researchers.
"There is lot of intelligence gathering and espionage-like behavior from the malware," Marcus said. "You can turn that to target any industry you want.
"It looks like the infection spread is specific to Middle East, but malware is indiscriminate in a lot of things so it can jump," he continued.
Marcus advised companies to not only keep network software up to date but to ratchet up security settings because threats such as Flame are carefully crafted to fly under the radar.
For example, Flame reportedly sneaked back out to the Internet by activating a seemingly innocuous Internet Explorer online browsing session.
Geographically targeted cyber espionage and even modular components in viruses have been around for years, Rik Ferguson of security firm Trend Micro said.
Flame stands out for being a malware behemoth of nearly 20 megabytes and for its use of Bluetooth capabilities, according to Ferguson, who branded the malware a tool, not a weapon.
"Flame's mission is not about stealing identities -- it's about gathering intelligence," senior researcher at Kaspersky Lab, Schouwenberg said. "Overall, regular consumers are not Flame's target."
Meanwhile, there is one way to ward off the malware: "Windows 7 64 bit, which we previously recommended as a good solution against infections with other malware, seems to be effective against Flame," the company said.
Kaspersky gives us something to think about..."Cyber weapons can replicate, and there could be random victims anywhere around the globe, it doesn't matter how far you are from the conflict," he said.
"It's not cyberwar, it's cyberterrorism and I'm afraid it's just the beginning of the game. I'm afraid that it will be the end of the world as we know it.I'm afraid that very soon the world will be very different."
Terrifying food for thought...!

How to Crack WEP/WPA network?

arsh — Fri, 01 Jun 2012 11:01:10 GMT

This entry aims at illustrating current security flaws in WEP/WPA/WPA2.

Successfully cracking a wireless network assumes some basic familiarity with networking principles and terminology, as well as working with command-line tools. A basic familiarity with Linux can be helpful as well.

Attempting to access a network other than your own, or one you have permission to use is illegal!!!

To successfully crack WEP/WPA, you first need to be able to set your wireless network card in "monitor" mode to passively capture packets without being associated with a network. This NIC mode is driver-dependent, and only a relatively small number of network cards support this mode under Windows.

One of the best free utilities for monitoring wireless traffic and cracking WEP/WPA-PSK keys is the aircrack-ng suite, which we will use throughout this article. It has both Linux and Windows versions (provided your network card is supported under Windows). The aircrack-ng site has a comprehensive list of supported network cards.

If your network card is not supported under Windows, one can use a free Linux Live CD to boot the system. BackTrack3 is probably the most commonly used distribution, since it runs from a Live CD, and has aircrack-ng and a number of related tools already installed.

Here, we use aircrack-ng version 1.0 on a Linux partition (Fedora Core 10, 2.6 32-bit kernel) on a Sony Vaio SZ-680 laptop, using the built-in Intel 4965agn network card. If you're using the BackTrack 3 CD aircrack-ng is already installed, with this version of linux it is as simple as finding it with:

yum search aircrack-ng
yum install aircrack-ng

The aircrack-ng suite is a collection of command-line programs aimed at WEP and WPA-PSK key cracking. The ones we will be using are:

airmon-ng - script used for switching the wireless network card to monitor mode
airodump-ng - for WLAN monitoring and capturing network packets
aireplay-ng - used to generate additional traffic on the wireless network
aircrack-ng - used to recover the WEP key, or launch a dictionary attack on WPA-PSK using the captured data.

1. Setup (airmon-ng)

To capture network traffic without being associated with an access point, we need to set the wireless network card in monitor mode. To do that under Linux, in a terminal window (logged in as root), type:

iwconfig (to find all wireless network interfaces and their status)
airmon-ng start wlan0 (to set in monitor mode, you may have to substitute wlan0 for your own interface name)

Other related Linux commands:

su (to switch to a root account)
ifconfig (to list available network interfaces, my network card is listed as wlan0)
ifconfig wlan0 down (to stop the specified network card)
ifconfig wlan0 hw ether 00:11:22:33:44:55 (change the MAC address of a NIC - can even simulate the MAC of an associated client. NIC should be stopped before chaning MAC address)
iwconfig wlan0 mode monitor (to set the network card in monitor mode)
ifconfig wlan0 up (to start the network card)
iwconfig - similar to ifconfig, but dedicated to the wireless interfaces.

2. Recon Stage (airodump-ng)

This step assumes you've already set your wireless network interface in monitor mode. It can be checked by executing the iwconfig command. Next step is finding available wireless networks, and choosing your target:

airodump-ng mon0 - monitors all channels, listing available access points and associated clients within range. It is best to select a target network with strong signal (PWR column), more traffic (Beacons/Data columns) and associated clients (listed below all access points). Once you've selected a target, note its Channel and BSSID (MAC address). Also note any STATION associated with the same BSSID (client MAC addresses).

WEP is much easier to crack than WPA-PSK, as it only requires data capturing (between 20k and 40k packets), while WPA-PSK needs a dictionary attack on a captured handshake between the access point and an associated client which may or may not work.

3. Capture Data (airodump-ng)

To capture data into a file, we use the airodump-ng tool again, with some additional switches to target a specific AP and channel. You should restrict monitoring to a single channel to speed up data collection, otherwise the wireless card has to alternate between all channels. Assuming our wireless card is mon0, and we want to capture packets on channel 6 into a text file called data:

airodump-ng -c 6 bssid 00:0F:CC:7D:5A:74 -w data mon0 (-c6 switch would capture data on channel 6, bssid 00:0F:CC:7D:5A:74 is the MAC address of our target access point, -w data specifies that we want to save captured packets into a file called "data" in the current directory, mon0 is our wireless network adapter)

You typically need between 20,000 and 40,000 data packets to successfully recover a WEP key.
One can also use the "--ivs" switch with the airodump-ng command to capture only IVs, instead of whole packets, reducing the required disk space. However, this switch can only be used if targeting a WEP network, and renders some types of attacks useless.

4. Increase Traffic (aireplay-ng) - optional step for WEP cracking

An active network can usually be penetrated within a few minutes. However, slow networks can take hours, even days to collect enough data for recovering the WEP key.

This optional step allows a compatible network interface to inject/generate packets to increase traffic on the wireless network, therefore greatly reducing the time required for capturing data. The aireplay-ng command should be executed in a separate terminal window, concurrent to airodump-ng. It requires a compatible network card and driver that allows for injection mode.

Assuming your network card is capable of injecting packets, in a separate terminal window try:

aireplay-ng -3 -b 00:0F:CC:7D:5A:74 -h 00:14:A5:2F:A7:DE -x 50 wlan0
-3 --> this specifies the type of attack, in our case ARP-request replay
-b ..... --> MAC address of access point
-h ..... --> MAC address of associated client from airodump
-x 50 --> limit to sending 50 packets per second
wlan0 --> our wireless network interface

To test whether your NIC is able to inject packets, you may want to try: aireplay-ng -9 wlan0.
To see all available replay attacks, type just: aireplay-ng

5. Crack WEP (aircrack-ng)

WEP cracking is a simple process, only requiring collection of enough data to then extract the key and connect to the network. You can crack the key while capturing data. In fact, aircrack-ng will re-attempt cracking the key after every 5000 packets.

To attempt recovering the WEP key, in a new terminal window, type:

aircrack-ng data*.cap (assuming your capture file is called data...cap, and is located in the same directory)

If your data file contains ivs/packets from different access points, you may be presented with a list to choose which one to recover.
Usually, between 20k and 40k packets are needed to successfully crack a WEP key. It may sometimes work with as few as 10,000 packets with short keys.

6. Crack WPA or WPA2 PSK (aircrack-ng)

WPA, unlike WEP rotates the network key on a per-packet basis, rendering the WEP method of penetration useless. Cracking a WPA-PSK/WPA2-PSK key requires a dictionary attack on a handshake between an access point and a client. What this means is, you need to wait until a wireless client associates with the network (or deassociate an already connected client so they automatically reconnect). All that needs to be captured is the initial "four-way-handshake" association between the access point and a client. Essentially, the weakness of WPA-PSK comes down to the passphrase. A short/weak passphrase makes it vulnerable to dictionary attacks.

To successfully crack a WPA-PSK network, you first need a capture file containing handshake data. This can be obtained using the same technique as with WEP in step 3 above, using airodump-ng.

You may also try to deauthenticate an associated client to speed up this process of capturing a handshake, using:

aireplay-ng --deauth 3 -a MAC_AP -c MAC_Client mon0 (where MAC_IP is the MAC address of the access point, MAC_Client is the MAC address of an associated client, mon0 is your wireless NIC).
The command output looks something like:
12:34:56 Waiting for beakon frame (BSSID: 00:11:22:33:44:55:66) on channel 6
12:34:56 Sending 64 directed DeAuth. STMAC: [00:11:22:33:44:55:66] [ 5:62 ACKs]

Note the last two numbers in brackets [ 5:62 ACKs] show the number of acknowledgements received from the client NIC (first number) and the AP (second number). It is important to have some number greater than zero in both. If the first number is zero, that indicates that you're too far from the associated client to be able to send deauth packets to it, you may want to try adding a reflector to your antenna (even a simple manilla folder with aluminum foil stapled to it works as a reflector to increase range and concentrate the signal significantly), or use a larger antenna.

Once you have captured a four-way handshake, you also need a large/relevant dictinary file (wordlists) with common passphrases.

You can, then execute the following command in a linux terminal window (assuming both the dictionary file and captured data file are in the same directory):

aircrack-ng -w wordlist capture_file (where wordlist is your dictionary file, and capture_file is a .cap file with a valid WPA handshake)

Cracking WPA-PSK and WPA2-PSK only needs 4 packets of data from the network (a handshake). After that, an offline dictionary attack on that handshake takes much longer, and will only succeed with weak passphrases and good dictionary files. A good size wordlist should be 20+ Megabytes in size, cracking a strong passphrase will take hours and is CPU intensive.

Cracking WPA/WPA2 usually takes many hours, testing tens of millions of possible keys for the chance to stumble on a combination of common numerals or dictionary words. Still, a weak/short/common/human-readable passphrase can be broken within a few minutes using an offline dictionary attack. A modern laptop can process over 10 Million possible keys in less than 3 hours.

WPA hashes the network key using the wireless access point's SSID as salt. This prevents the statistical key-grabbing techniques that broke WEP, and makes hash precomputation more dificult because the specific SSID needs to be added as salt for the hash. There are some tools like coWPAtty that can use precomputed hash files to speed up dictionary attacks. Those hash files can be very effective (since they're much less CPU intensive and therefore faster), but quite big in size. The Church of WiFi has computed hash tables for the 1000 most common SSIDs against a million common passphrases that are 7Gb and 33Gb in size.

what we can conclude...

WEP cracking has become increasingly easier over the years, and what used to take hundreds of thousands packets and days of capturing data can be accomplished today within 15 minutes with a mere 20k data frames.

WPA/WPA2-PSK encryption is holding its ground if using a strong, long key. However, weak pass-phrases are vulnerable to dictionary attacks. WPA/WPA2 may be on borrowed time as well...

Torrent Leeching

arsh — Mon, 30 Jan 2012 10:10:10 GMT

I ADVISE AGAINST THIS!!!

If you’ve just started using BitTorrent, you may not be fond of the whole "allow people to upload while you download” thing. It kills your bandwidth, and can make using the internet at all difficult, especially if you don’t have a powerful internet connection. It can also pose a great problem if your internet has upload/download limits, and you don’t want to just keep seeding after you finish your download, and thus use up your upload limit rather quickly. (Most places, such as colleges, that use upload/download limits set the upload limit to be much lower than the download limit, so you really need to watch out for that when torrenting).

Here, you’ll learn about how to tweak your settings in uTorrent to minimize your upload amount and still get the best download speeds you can.

The easiest way to do this would be to use the built in uTorrent tools Speed Guide Wizard. Open up uTorrent, and go to Options -> Speed Guide. It will then bring up the wizard.
The first thing you want to do is find out what speed your internet connection gets. Click the big button that says "Run Speed Test” in the Speed Guide.
Select whichever version that applies to you. If you are unsure of which to use, select the Flash 8 one (first choice). If you know that you have Fios (fiber optics, such as Verizon), select the Java based one.
At the next window, you will be given a choice of different servers found in different cities throughout America. Choose the city that is closest to you and continue. The test should then start automatically.
Allow the test to complete (it will come up with both a download and upload number, MOST of the time the download will be higher than the upload number).
The number of interest is the download value. It will be given in Kb/s, so if the number that is given is over 1,000, divide it by 1,000 and consider it to be Mb/s from now on. As you can see in the image, my download speed was 2,310 Kb/s, and that becomes 2.31 Mb/s.
Back in the Speed Guide Wizard, the dropdown for Connection Type will have many different values. Provided that you don’t have dial-up (most likely not if you’re torrenting things), select the choice that is closest to your download value. For example, since my download speed was 2.31 Mb/s, I selected the "xx/2Mbit” choice because 2Mb is closest to 2.31 Mb/s. You preferably want to round down because it’s better to give less bandwidth to the torrents than to give it too much and tax your whole internet connection.
Once you select that Connection Type, it will automatically change certain settings to the optimal values.
Then, make sure you have your port properly forwarded. The Speed Guide has a handy button that can test to see if your port is forwarded correctly or not.
Hit "Use Selected Settings” to save your settings. That just makes your torrents go at the optimal speed possible with your internet connection. Now, the following steps will show you how to become a sneaky leech.
In uTorrent, go to Options -> Preferences. The following steps illustrate what the settings should be in each tab. The three underlined settings are the most important to reduce total upload amounts.
Connection -> Add Windows Firewall Exception: True
Bandwidth -> Max Upload Rate: (some numerical value other than 0, generated by Speed Guide – I have 186 kB/s)
Bandwidth -> Max Download Rate: 0 kB/s (unlimited, you don’t want to hinder downloads, but to make them go as fast as possible)
Bandwidth -> Number of Upload Slots per Torrent: 8 (again, generated by Speed Guide)
Queuing -> Seed While Ratio s: 0% or seeding time is: <= 0 min
Queuing -> Seeding tasks have higher priority than downloading tasks: false (unchecked)
Queuing -> When uTorrent reaches the Seeding Goal: Limit the upload rate to: 0 kB/s

Since your internet connection’s upload speed is usually the limiting factor when torrenting, by taking these few simple steps, you can increase your torrenting efficiency a lot. The upload rate limit will prevent the torrent from hogging too much instantaneous upload bandwidth, and the last three underlined settings force the torrents to stop seeding, saving your total upload amount (incase you have upload limits or don’t want constant internet activity). This is useful not only for internet services with caps on upload/downloads, but also for if you leave a download going overnight and don’t want to waste bandwidth uploading after it finishes.

Given all this, I must say, personally I loathe leechers. :P But sometimes, you gottA do what you gottA do!

Biggest mistakes in Hollywood regarding computers

arsh — Sat, 31 Dec 2011 18:31:54 GMT

Hollywood Goofs on Computers...

Why does Hollywood always put computer noises into scenes involving computers, even though there should be no noises whatsoever? All of us, including everyone in Hollywood, use a computer every day, and know that computers do not "bloop" and "beep" every time you press the mouse button, yet you still get it wrong. You make so very many computer mistakes, Hollywood, but here are your top three.

MISTAKE #1: THE OBLIGATORY LOADING BAR.

Every time a computer has a loading bar, which for some reason is every time any request is executed, the bar makes a noise as it loads. Loading bars don't do that. If they did, we would all kill ourselves every time we tried to watch a Flash movie.

As a matter of fact, I can't really think of any application that shows a loading bar. Sure, there are progress bars when I illegally download some of your movies, and happy file icons fly back and forth when I empty the stash of sub-standard pornography dwelling in my recycle bin. When I load some programs, particularly Adobe programs, there is a lengthy progress bar. But those progress bars are silent. Completely silent.

Also, loading bars don't appear every time I double-click an icon. But maybe that's because my life doesn't require a necessary element of suspense.

MISTAKE #2: HACKERS ARE UGLY.

Why was there a movie called Hackers that featured attractive people? Here's what real-life hackers look like:

Kevin Mitnick "Withered Rose"

A real, live female hacker, Unidentified Teenage Hacker

Susan Thunder

Here's what Hollywood hackers look like:

While we're on the subject of hackers: let's say a movie hacker sits down in a smoky room to do some h4xx0ring. He pulls a laptop from his satchel, sets it on a table, opens it up, and the viewer is greeted with the souless glow of an Apple logo. In the interest of disclosure, I was once a member of the cult of Jobs, but even then I knew better than to believe a hacker would use a Mac. That would be like the black character in a movie not dying first.

MISTAKE #3: THE FAKE OPERATING SYSTEM.

When HP or Dell or Gateway or Sony sponsors a movie, and every piece of computer equipment in the universe of the film features the company logo, please do not have your graphics guys slap a completely unrealistic and phony operating system onto the 30" LCD with HDMI-in.

Listen, Hollywood: everyone uses Windows, Mac, or Linux. And the GUIs of each OS is basically the same. Why would your mystical operating systems have insanely graphically-intense interfaces, only to take three minutes to save something to a floppy disk via the beeping progress bar?

This computer turns around...

...to reveal this top-secret login screen

Much like the coldness of space is utterly silent, except in movies where it is rich with engine noises, blaster squeals, and fiery explosions, my computer is nearly silent. Occasionally it makes a noise to tell me I broke something, but never when it finishes saving a file or spellchecking.

We all use computers, Hollywood. We know what they're like. Stop trying to ignore the fact that even in the midwest, a place most of you know only from 35,000 feet, people are not as stupid as you think.

But, still, we enjoy what you do... :) What do you think people??

HTTP Client-Side Exploit --- A Tutorial

arsh — Sat, 31 Dec 2011 14:51:51 GMT

Real-Life HTTP Client-Side Exploitation Example

This section illustrates an example of a real life attack conducted against an organization that resulted in loss of critical data for the organization.

In this attack, Acme Widgets Corporation suffered a major breach from attackers who were able to compromise their entire internal network infrastructure using two of the most powerful and common attack vectors today: Exploitation of client-side software and pass-the-hash attacks against Windows machines.

Step 0: Attacker Places Content on Trusted Site

In Step 0, the attacker begins by placing content on a trusted third-party website, such as a social networking, blogging, photo sharing, or video sharing website, or any other web server that hosts content posted by public users. The attacker's content includes exploitation code for unpatched client-side software.

Step 1: Client-Side Exploitation

In Step 1, a user on the internal Acme Widgets enterprise network surfs the Internet from a Windows machine that is running an unpatched client-side program, such as a media player (e.g., Real Player, Windows Media Player, iTunes, etc.), document display program (e.g., Acrobat Reader), or a component of an office suite (e.g., Microsoft Word, Excel, Powerpoint, etc.). Upon receiving the attacker's content from the site, the victim user's browser invokes the vulnerable client-side program passing it the attacker's exploit code. This exploit code allows the attacker to install or execute programs of the attacker's choosing on the victim machine, using the privileges of the user who ran the browser. The attack is partially mitigated because this victim user does not have administrator credentials on this system. Still, the attacker can run programs with those limited user privileges.

Step 2: Establish Reverse Shell Backdoor Using HTTPS

In Step 2, the attacker's exploit code installs a reverse shell backdoor program on the victim machine. This program gives the attacker command shell access of the victim machine, communicating between this system and the attacker using outbound HTTPS access from victim to attacker. The backdoor traffic therefore appears to be regular encrypted outbound web traffic as far as the enterprise firewall and network is concerned.

Steps 3: Dump Hashes

In Step 3, the attacker uses shell access of the initial victim system to load a local privilege escalation exploit program onto the victim machine. This program allows the attacker to jump from the limited privilege user account to full system privileges on this machine. Although vendors frequently release patches to stop local privilege escalation attacks, many organizations do not deploy such patches quickly, because such enterprises tend to focus exclusively on patching remotely exploitable flaws. The attacker now dumps the password hashes for all accounts on this local machine, including a local administrator account on the system.

Step 4: Use Pass-the-Hash Attack to Pivot

In Step 4, instead of cracking the local administrator password, the attacker uses a Windows pass-the-hash program to authenticate to another Windows machine on the enterprise internal network, a fully patched client system on which this same victim user has full administrative privileges. Using NTLMv1 or NTLMv2, Windows machines authenticate network access for the Server Message Block (SMB) protocol based on user hashes and not the passwords themselves, allowing the attacker to get access to the file system or run programs on the fully patched system with local administrator privileges. Using these privileges, the attacker now dumps the password hashes for all local accounts on this fully patched Windows machine.

Step 5: Pass the Hash to Compromise Domain Controller

In Step 5, the attacker uses a password hash from a local account on the fully patched Windows client to access the domain controller system, again using a pass-the-hash attack to gain shell access on the domain controller. Because the password for the local administrator account is identical to the password for a domain administrator account, the password hashes for the two accounts are identical. Therefore, the attacker can access the domain controller with full domain administrator privileges, giving the attacker complete control over all other accounts and machines in that domain.

Steps 6 and 7: Exfiltration

In Step 6, with full domain administrator privileges, the attacker now compromises a server machine that stores secrets for the organization. In Step 7, the attacker exfiltrates this sensitive information, consisting of over 200 Megabytes of data. The attacker pushes this data out to the Internet from the server, again using HTTPS to encrypt the information, minimizing the chance of it being detected.

hang and boot the victim's computer

PREET — Tue, 27 Dec 2011 14:24:18 GMT

YAHOO BOOTER

Yahoo booters are softwares that use packet codings to send the victim‘s computer using yahoo messenger, these pack codes contain some information and codes that computer can not understand, so computer gets hanged or slowed down by processing these packets, there are lots of different kinds of packets created by programmers to boot yahoo users in different ways, like disconnecting them from yahoo messenger and internet, or hanging their computer, or closing their yahoo messenger or sending them thousands of IM messages from different yahoo ids.Here is latest Ybooter.

SSL Login Booter It supposed to hit Yahoo Messenger 8 and 9 and 10 User and some client with an exploit in Disconnect option. This exploit also boot the latest yahoo messenger 10. It will disconnect latest yahoo messenger 10. If your bot does not login, try to change your bots and password. Login problem? Just make sure you copy and paste VoodoEncrypt15.dll at your /system and /system32 folder.

Suggesion: -" We using Yahoo Booter is illegal to use and this article is just for education purpose only.”

Indian ISPs To Block File Sharing Sites | Reliance BSNL Airtel

PREET — Sun, 30 Oct 2011 17:16:06 GMT

Indian ISPs To Block File Sharing Sites

| Reliance BSNL Airtel

Guess what guys?? To Stop Piracy illegal contents and Downloads of Illegal softwares,pirated Movies, The Department Of Telecom of India [DoT] has Given Instructions To Indian ISPs such as Reliance,Bharti Airtel,Tata , BSNL etc To Block Popular File Hosting Sharing And Media Hosting And Sharing Sites such as

01. Megaupload.com
02. Mediafire.com
03. Megavideo.com
04. VideoBB.com
05. Novamov.com
06. Movshare.net
07. Rapidshare.com
08. Putlocker.com
09. Hotfile.com
10. Fileserve.com
11. Filesonic.com
12. Filesonic.in
13. Depositfiles.com
14. Wupload.com

This is the worst decision ever made... Imagine life without file sharing! That's like going back to the Stone Ages :( ruined the day for me! What do you say??

How to Secure your Windows Account

arsh — Sat, 29 Oct 2011 20:05:19 GMT

Windows XP Secure User Accounts

At some point of time, we all have been asked to reinstall Windows XP Home for a relative that is somewhat computer illiterate. Troubleshooting the constant crashes and investigating the extreme slowness was not something you want to bother with.

Therefore, I decided to create this guide to show you how to property configure a Windows XP Home computer’s user accounts for optimum security. This tutorial will assume the reader is a basic home user and this system is not part of a network.

Navigation may vary dependent on the view of the user. I’m using classic view for this guide. If you are using category view there may be extra steps involved. To switch to classic view go to Start menu > control panel … in the upper left you can switch your view.

User Account Settings

The first thing you must do is determine how complex user accounts need to be. I don’t advice operating the computer as the default administrator on a regular basis. This opens up an array of potential vulnerabilities. I’ll show you a command to access admin functions as a regular user shortly. I recommend only one administrative account per computer and one limited user account for each person having access to the computer.

start menu > control panel > user accounts > create a new account for each person who will use the computer. Choose limited account type for each user.

Go into each account and have the user choose a unique password. Six to Eight characters alpha and numeric is ideal.

Run As

Having limited access users adds to the security of the system, but includes a small hurdle when attempting to run certain applications, install software, or apply updates. Run As is a command that runs a program as an administrator from a limited account.

Locate the icon of the program you wish to run
Hold down SHIFT and right click the icon
Click Run as
Run the program as the following user
Choose the username of the admin account and type in the password

The program will launch as if the administrator account was logged in.

Now we’ll need to configure folder options for each user.

File Extensions and Association

File extensions are the three letters following the period in a file name. The association is the program that opens those files relative to their extension.

Examples:
.html – Internet Explorer
.doc – Microsoft Word
.txt – Notepad

By default Windows hides these extensions from the user. Therefore, a file named "Homework.exe” (exe = executable) would be seen only as "Homework”. This is a masquerading technique of viruses and such. To remedy this problem we’ll need to change the folder options for each user.

Start menu > control panel > folder options > view tab
Uncheck "Hide file extension for known file types”

Now we can identify what type of file we are clicking on.

Click on File Types tab
Click on the extensions JS, JSE, OTF, REG, SCT, SHB, SHS, VBE, VBS, WSC, WSF, and WSH
For each click the Change button and select notepad
Click ok

The most common malicious software uses those extensions. If you accidentally click on "virus-name.jse”, it will now open in notepad and not execute the code.

Secure Windows XP registry, logs, and passwords

Windows XP stores security relevant items in the folders C:\Windows\Repair and C:\Windows\System32\config. Browse to their location and allow only the administrator and the system access.

My computer > C drive (windows installation drive) > Windows
Right click over the Repair folder
Select properties
Click on the Security tab
Select Users
Uncheck Allow for all but "List Folder Contents”

Congratulations!

Each user has a password protected account
Admin rights are not active during daily use
The Run As command is a safe way to administer the computer
File extensions are readily identified to the user
File associations link to safe programs
Important Windows folders are protected from general users

Remember all the security configurations in the world won’t help a user with careless activity!

Security flaw in Skype

arsh — Sat, 29 Oct 2011 16:48:26 GMT

Latest Security Flaw in Skype Enables IP address & Location Tracking

The serious breach in the widely-used, internet video chat program means that any evil computer nerd could easily hunt down users' whereabouts, according to a study co-authored by an NYU-Poly professor.

The flaw in Skype could allow a skilled hacker to find out the IP address from which a user has logged in to Skype, thereby determining the location of Skype users, which is a massive breach of privacy and security. The company is trying to downplay the flaw, claiming that the ability to derive IP addresses was common with all web based communication clients.

The flaw can reportedly be exploited without the user’s knowledge, and can be executed on a massive scale. The reserch team demonstrated this by scheduling hourly calls to tens of thousands of Skype users.

Adrian Asher, Skype's chief information security officer, said that IP addresses are easily uncovered in most web communications clients."Just as with typical Internet communications software, Skype users who are connected may be able to determine each other's IP addresses. Through research and development, we will continue to make advances in this area and improvements to our software," he told.