[SecurityRatty] tag: billy

Scrawlr: Are We Being Too Greedy?

Wed, 25 Jun 2008 12:19:45 +0000

HP released a new tool called Scrawlr yesterday that can be used to identify a subset of SQL Injection vulnerabilities in a website. It was a joint effort with Microsoft and a direct response to the mass SQL Injection attacks of late.

Scrawlr quickly came under fire on the Web Security mailing list for having some pretty major limitations. Billy Hoffman et al have been quick to point out that the tool was designed to address a very specific subset of SQL Injection vulnerability — the type affected by the mass attacks — and is not designed to be a general purpose replacement for existing SQL Injection scanners. Let’s look at the limitations, as outlined on the HP page, one by one.

Limitation: Will only crawl up to 1500 pages

Depends on what they mean by 1500 pages. For example, if I have these links on my front page, is that one URL or three?

http://www.veracode.com/blog/?p=111&foo=1
http://www.veracode.com/blog/?p=111&foo=2
http://www.veracode.com/blog/?p=111&foo=3

Or, does it mean that it will really only crawl 1500 pages total, so if I have the same link 1500 times on the front page, it won’t go any further? Either way, for most smaller websites this is probably fine. If you need more than 1500 you could give it different starting URLs in an attempt to improve coverage. It would be nice to have a clearer definition of what it means to “crawl up to 1500 pages” though.

Limitation: Does not support sites requiring authentication

Well, this will render it useless for the majority of enterprise apps. But there are still a lot of sites out there that don’t require authentication, including some of the ones that got hit during the mass attacks, such as the United Nations, UK government, etc.

Limitation: Does not perform Blind SQL injection

They have taken a lot of flack for this but Billy describes it as a conscious choice:

An early version of the tool checked for blind SQL injection, but the final verison of Scrawlr did not. … The biggest feedback we got from early testing was developers wanted to “see” the vulnerability. Differential analysis is kind of difficult to visualize in a way that is helpful for the average dev, and pulling the table names through blind was too much of a performance issue.

I can sort of understand this rationale. Blind SQL Injection testing is much more susceptible to false positives. As users of any commercial web scanner or source code analyzer will attest, the more time you spend chasing down FPs, the less likely you are to put any faith in future results. It’d be nice if there was a way to toggle Blind SQL Injection testing on and off, though (could be off by default so nobody gets confused).

Limitation: Cannot retrieve database contents

Who cares? Find and fix the vulnerability. Pulling down the entire database “because you can” is a total ego move.

Limitation: Does not support JavaScript or flash parsing

Nobody does this very well anyway, particularly the JavaScript part. Writing a great crawler is probably the hardest part of writing an automated web scanner and it’s one of the biggest differentiators from one product to the next. You’re not going to get that for free.

Limitation: Will not test forms for SQL Injection (POST Parameters)

This is probably the toughest one to swallow. It’s not that difficult to parse out forms from HTML, and form POSTs can represent a major chunk of the attack surface. Granted, the Chinese tool associated with the mass attacks did operate solely on GET requests (i.e. parameters in the query string) so HP can defend this again by saying the tool is really aimed at the sites being targeted by the mass attacks. I think it’s a little short-sighted though; chances are that the mass attacks will evolve and it’s better to be proactive about it than reactive.

Conclusion

It’s tough to bash someone for releasing a free tool. I personally think HP should add an option for enabling Blind SQL Injection testing, and that they should consider supporting POSTs as well as GETs. You’re basically getting a (massively) stripped-down WebInspect for free, so take it for what it is. No single tool is a panacea.

The jury is still out on how effective Scrawlr is against the things it does claim support for. Keep watching the Web Security list; the reviews are filtering in.

Stealing Password Hashes with Java and IE

Mon, 09 Jun 2008 07:34:54 +0000

OK, I read a lot, I mean a lot on a regular basis. There is a lot of tripe floating about the tubes of the internet and I’m always pleased to read a new posting from several folks who buck that trend. Among which I count John Heasman. He has a great new post on his site about stealing password hashes with Java and Internet Exploder.

From Aut Disce, Aut Discede:

Consider for a moment the state of client-side bugs 5 or 6 years ago. Attacks such as this, a multi-stage miscellany of IE and Mediaplayer bugs that resulted in the “silent delivery and installation of an executable on the target computer, no client input other than viewing a web page” were reported with regularity. Gradually these type of attack gave way to exploitation of direct browser implementation flaws such as the IFRAME overflow and DHTML memory corruption flaws. So what has become of the multi-stage attacks - have they become redundant? The answer to this, which I’m sure you can guess, is a resounding “no” and will be emphatically demonstrated in my upcoming Black Hat talk “The Internet is Broken: Beyond Document.Cookie - Extreme Client Side Exploitation”, a joint double session presentation co-presented by Billy Rios, Nate McFeters and Rob Carter.

As a teaser for that, I’m going to revisit an old attack - pre-computed dictionary attacks on NTLM - and discuss how we can steal domain credentials from the Internet with a bit of help from Java. I’m going to split it into two posts. In this post we’ll apply the attack to Windows XP (a fully patched SP3 with IE7). In my next post we’ll consider its impact on Windows Vista.

For the full article read on.

Why are you still here? Go read it.

Article Link

Latest linking of Senator Obama to a '70's terrorist may damage his reputation.

Sun, 11 May 2008 20:12:00 +0000

We all know how important it is to have a good reputation and the price we pay when it becomes damaged. The latest reports linking Senator Obama with the 70's radical, William Ayers, can not help him in his nomination bid.

William "Billy" Ayers was a member of the '70's domestic terrorist group: Weather Underground Organization (WUO). WUO were opposed to the Vietnam war and pledged to bomb the Capitol, The Pentagon and Police Stations after issuing a "declaration of a state of war" against the United States Government in 1970.

These days, Ayers is a professor at UIC. Apparently, Ayers and the Senator have served jointly on various Boards and have appeared on discussion panels together. Most likely Senator Obama failed to do the proper due diligence on his co-host and was unaware of his terrorist affiliations and involvement. Unfortunately for the Senator, many voters may not be so forgiving, especially when they realize that Ayers has recently made comments to the effect that he does not regret planting bombs and thinks he did not do enough. He even went so far as to state that he can not entirely dismiss the idea of planting a bomb today.

Last week during training of an Executive Protection class in Baltimore, I spoke about the need to keep an open mind when it comes to terrorism and to realize that terrorists come in all shapes, sizes and colors. I even discussed domestic terrorism and drew their attention to the Weather Underground. We should remember that terrorists will not always arrive looking as they do in television footage.

For instance, Timothy McVeigh could walk down any street in the U.S. prior to the bombing in Oklahoma and not one single person would ever have suspected him of being a home-grown terrorist. Everything (and everybody) is not always what it seems.

Confidential information sent to PinPay.net and SoftCard.biz is exposed

Thu, 08 May 2008 09:26:03 +0000

Technorati Tag: Security Breach

Date Reported:
4/29/08

Organization:
ACAP Security Inc.

Contractor/Consultant/Branch:
PinPay
SoftCard

Victims:
Merchants, Agents and customers

Number Affected:
Unknown

Types of Data:
Name, mailing address, phone number, email address, date of birth, city of birth, sex, and one or more of the following (chosen from drop-down):

Passport
Voting ID card
PAN card
Driving License card
Government issued ID card
Social Security Card
Military ID card
Consular ID card
Postal ID card
Government Employee ID Card
Credit Card
Debit Card

Breach Description:
ACAP Security and affiliated sites are actively marketing a "secure payment system that allows Internet-based businesses to accept secure PIN-debit card payments and transactions at their online store." The PinPay and SoftCard sign-up pages and account access pages are not adequately secured with encryption, potentially exposing extremely sensitive personal information.

Reference URL:
Merchant 911 Blog

Report Credit:
Tom Mahoney, the Founder and Director of Merchant 911

Response:
From the online source cited above and my own cursory investigation:

Back in January, I had short email dialog with a Kip Long, who claimed to be one of the principles of a company called Softcard out of Huntington Beach, CA. They are not to be confused with SoftCard Systems in Athens, GA. As far as I know, SoftCard Systems is a legitimate company with a legitimate product.

Mr. Long was rather aggressively, but not very successfully, trying to impress me with their product - from what I can make of it, a virtual PIN based card.

The company uses PinPay - to process transactions and both companies are a part of ACAP Security, Inc..

I reviewed their site for possible inclusion in our website’s resource pages, but promptly rejected them.

their insecure sign-up form - was requesting “Identity Card Numbers” and issue dates.
[Evan] The sign-up forms at SoftCard.biz and PinPay.net are not secure. Neither are their respected login pages.

“Identity cards” are selectable from a drop down menu and include such ID information as Passport, Driver’s license, SSN, and Credit Card.

The form also requires a full name and DOB.

I tried using the HTTPS URL but it appears that they do not have a security certificate tied to their site.

The fact that Mr. Long used a hotmail address to pitch the company made me wonder too, given that at Merchant911 we try to instill in our members that a free email address from a customer is a fraud alert.

If a company official can’t use his company’s domain for email, I’m not going to talk to him.

I called their attention to the insecure web form in January. They still have the form up there, happily collecting this information with an insecure form.
[Evan] I also sent emails and heard nothing in return.

I have to wonder how much information has already been sniffed or otherwise compromised. You probably don’t want to fill out this form.
[Evan] My advice would be to NOT fill out the form and NOT conduct business with a company that has not demonstrated a willingness to secure your information.

Commentary:
Tom informed me about this vulnerability (and potentially a breach for anyone that signed-up/in) a couple of weeks ago. I've been a little busy lately, but was finally able to check it out. Let me recap what I found.

First, let's go to www.softcard.biz. This is the site that Tom originally pointed out to me.

The flash home page forwards visitors to a static index (indexaa.html) page. The first paragraph on the page informs visitors about PinPay.

"The PINPAY SoftCard is a wise way to carry and transfer money. It gives you the ability to purchase products at participating stores throughout the world (as well as at online shopping malls), with the security of a PIN that travels the internet via private encrypted tunnels. It also allows you the ability to load money to your card, pay bills, transfer money to merchants, transfer money between cards, and withdraw cash from your card at the store."

See where the page says, "Register for your FREE card HERE!!"? This is a link to the sign-up page that Tom was referring to.

No "https" in the URL. Tom was right on that. The sign-up form asks for a personal information ranging from name and address to identity card information (even information for a "Second Identity Card").

The "Select Identity Card" drop down menu displays the choices for the prospective customer, including Passport, Voting ID card, PAN card, Drivers License card, Government issued ID card, Social Security card, Military ID card, Consular ID card, Postal ID card, Government Employee ID Card, Credit Card and Debit Card

SoftCard (or PinPay or ACAP Security) are asking for some very sensitive personal information! First, this is quite a bit more information than they need to approve a person for a "PINPAY SoftCard". Second, no encryption?! Third, who is ACAP/SoftCard/PinPay and what will they do to secure my information once they have it supposing it wasn't intercepted on the way to them?

Let's dig a little (public) information about ACAP Security. According to Entreprenuer.com, ACAP launched "Personal Private Network" (ppn) technology, commercially available under the trade name ppnPRO, which is described as a "highly secure, and highly private" personal private network. ppnPRO uses "Government approved AES encryption, with strong personalized 256-bit encryption keys, and encrypting all information- network addresses, applications and ports, as well as the confidential data content". Sounds impressive, but it also sounds like the company should know a thing or two about securing web site transactions with encryption.

I want to discuss the risk of sending confidential private information over a public network such as the internet without encryption, in particular. This is not a new topic, but I will take some time to demonstrate the risk.

In order for my information to be compromised, someone (or something) will need to capture the traffic. In order for someone to capture my traffic, they will need to tap into the communication somewhere between me (my computer) and the destination (the web server). My information doesn't travel directly from my computer to the server. There are intermediaries (routers, switches, firewalls, etc.) that have to get (or forward) my information from my computer to the server.

As you can see depicted in the graphic above, there are at least 16 routers (or hops) between this example source and www.softcard.biz. The final few hops are not reported due to filtering. So where could my traffic be captured? At the very least:

Between my computer and my router (or firewall)
Between my firewall and the ISP hand-off
Between all the traversed devices within my ISP's network
Between all the traversed devices through the internet
Between all the traversed devices within the destination ISP's network
Between all the traversed devices within the destination organization's network and the server itself.

Anyone in the communication path can use a simple protocol analyzer like Wireshark and capture the sensitive information:

txtfname=Billy&txtmname=J&txtlname=Madison&txtaddress=123+Main+Street&txtcity=Anywhere&
txtstate=MA&txtzip=87451&txtcountry=United+States&mob_phone=NONE&txtphone=18006218200&
txtemail=billymadison@honky.com&txtdob=04%2F20%2F1988&txtbirthcity=Boston&
txtbirthcountry=United+States&txtgender=M&identity1=Social+Security+Card&txtcardno1=123-45-6789&
txtissuedate1=04%2F20%2F1988&identity2=Driving+License+card&txtcardno2=M-1234567890&
txtissuedate2=04%2F20%2F2006&submit=Accept+Card+Agreement-Submit

This is a very simplistic demonstration about why it is important to encrypt sensitive information. If the communication had been encrypted, none of the data would have been visible without access to the private key.

We could go deeper into the server application and SQL, but I think that this is enough.

A Quote from the ACAP Security CEO:
“The right of privacy is a fundamental and very important right of American society. A right our Nation’s founders fought the American Revolution to obtain and a right many brave American soldiers have fought and continue to fight and die to preserve. As this Nation continues to advance into cyberspace, we have expanded the right of privacy to include the right to electronic privacy. The elements of cyber-crime and cyber-vulnerabilities have begun to seriously erode and destroy this important right of electronic privacy.”

Past Breaches:
Unknown

Lost Bank of Ireland laptops affect roughly 10,000 customers

Tue, 22 Apr 2008 05:35:39 +0000

Technorati Tag: Security Breach

Date Reported:
4/22/08

Organization:
Bank of Ireland

Contractor/Consultant/Branch:
Drogheda, Dunleer, Bagnelstown, Court Place Carlow, Stephens Green, Tallaght, and Montrose

Victims:
"customers who either obtained a quote or took out a Life Assurance policy with Bank of Ireland Life from the following branches:

Drogheda
Dunleer
Bagnelstown
Court Place Carlow
Stephens Green
Tallaght
Montrose"

Number Affected:
~10,000

Types of Data:
"names, addresses, bank account details and medical histories"

Breach Description:
"DUBLIN--Four laptop computers stolen from one of Ireland's largest commercial banks contain the unencrypted details of some 10,000 customers, the bank said on Tuesday."

Reference URL:
Bank of Ireland
The Associate Press via International Herald Tribune
Agence France-Presse via Inquirer.net

Report Credit:
Data Protection Commissioner, Billy Hawkes

Response:
From the online sources cited above:

DUBLIN, Ireland: Four laptops containing the personal details of 10,000 Bank of Ireland customers have been stolen, the bank confirmed Monday.

Ireland's second-largest bank made the admission after the chief regulator, Data Protection Commissioner Billy Hawkes, told Irish broadcasters RTE he had been informed of the lost customers' data only last Friday.

Bank of Ireland said the four laptops disappeared between June and October 2007 and contained the names, addresses, bank account details and medical histories of about 10,000 holders of the bank's life insurance policies.

Commenting on the delay in reporting the thefts to the regulatory authorities, managing director Brian Forester said internal procedures had not been followed.
[Evan] Policies and "internal procedures" aren't worth squat if they aren't communicated to all affected persons AND enforced.

"Unfortunately in this situation the procedures were not properly adhered to. The thefts, while they were reported to the Gardai [police], the situation wasn't escalated to the level of management it should have been, through a human error," he said.
[Evan] Yes, human error indeed. Humans run the bank, humans run the information security program (assuming one exists), and humans collect, create, store, access, distribute and destroy confidential information. This was more like "humans error", meaning more than one.

The bank said it had found "no evidence of fraudulent or suspicious activity on any of these accounts."

The four laptops all disappeared in Ireland, at least one of them from a bank worker's home.

The laptops contained information relating to some customers who either obtained a quote or took out a Life Assurance policy with Bank of Ireland Life from the following branches:

Drogheda
Dunleer
Bagnelstown
Court Place Carlow
Stephens Green
Tallaght
Montrose

Anybody who is not a customer of these branches is not affected by this incident.

The customers' personal data was not encrypted to prevent easy access.
[Evan] Should we be surprised?

The bank said it was beginning to encrypt customers' data on its remaining 5,000 laptops
[Evan] Reactionary information security is ineffective. Organizations working with confidential information need to be proactive in risk management and information security in order to be effective. Let's think this through for a second or two. Here we have a bank (or a bank-owned entity) that has many highly confidential records. The bank employs ~5,000 laptop computers and encourages a mobile workforce. Do you think that there is a good (more than 50/50) chance that some of the laptops may be used to work with highly confidential information? Do you think there is a good chance that one of these laptops may be lost or stolen? Obviously the answer to both questions is "yes". Why then are these laptops not adequately protected? Is this another "human error"?

had yet to inform any of the 10,000 customers that their personal details had been compromised.

Bank of Ireland will be writing to these customers in the coming days.

a help-line has been set up to handle any customer queries 1850 365 365 and select the Bank of Ireland Life option

This customer help-line will be open from 9.00am to 6.00pm Monday to Friday.

Bank of Ireland apologises to customers and is committed to moving as quickly as possible to allay the concerns of affected customers.

Ireland's Data Protection Commissioner Billy Hawkes said his office was investigating what he described as "serious" security lapses.
[Evan] Of course my purview is very limited, but I tend to agree that there are some serious information security gaps at The Bank of Ireland.

Commentary:
Baffling is the first word that comes to mind. Poorly protected confidential information and a poor incident response.

Past Breaches:
Unknown

Now batting for the NY Yankees ... Billy Crystal, number 60

Thu, 13 Mar 2008 22:23:48 +0000

Imagine Bob Sheppard's one of a kind voice booming over the PA system at Yankee Stadium. The words echoing off the hallowed stands that Ruth built, near first base where Gerhig stood, over the green grass of centerfield where DiMaggio and Mantle roamed. Ladies and Gentlemen, now hitting for the NY Yankees, number 60, Billy Crystal. For one of my favorite comedians, a life long dream came true for his 60th birthday.

It is no secret that Crystal who grew up in Long Beach, Long Island is a die hard, crazy Yankee fan. Today the Yankees probably made him "the luckiest man on the face of the earth", or at least since another Yankee said those words. They signed Billy to a one day contract and let him suit up and take an at bat in a pre-season game. Alas, the mighty Crystal struck out, but not before fouling a ball off down the line and running the count to 3 and 2. What a special event and great thing to do for a special fan. I can only imagine the goose bumps that Billy for sure had! Classy move by the Yankees.

This is the last year for the greatest sports venue in America, Yankee Stadium. I very much want to take my boys up this season to see at least one game in the old stadium. In the meantime if anyone really wants to make me happy, maybe you can finagle to get me a similar stint with the Yanks. If not I would settle for coming and playing QB for the Steelers for a play as well. But I guess I am no Billy Crystal, but I can dream can't I? Like Yogi says, it ain't over till its over.

Now batting for the NY Yankees ... Billy Crystal, number 60

Thu, 13 Mar 2008 21:29:49 +0000

HP Corners the Market on Hackers

Mon, 11 Feb 2008 21:31:42 +0000

I thought this was a pretty funny quote from this article.

Nine out of the world’s top 11 security hackers came to HP through the SPI Dynamics acquisition, he boasts, although it’s not immediately clear who ranked those top 11.

The “he” is Mark Potts CTO of Software, Hewlett-Packard. When I read that the first thing that came to mind was; Billy Hoffman is top 10 material? The end is near!! (joking…) Then I wondered who is ranking hackers and how much would it cost to get the #1 spot. Then later I thought there must be a real ranking because if you where making it up you would just say “nine out of the top ten, not 9 out of the top 11″ which would generally mean you had 8 of the top ten and one person at eleven so you went for Top eleven instead of top ten. Maybe people from Australia use a top 11 system?

Is Your Security Consultant Hacking You?
I am surprised I didn't think of this! :-) This security consultant was not satisfied with a high bi...
PCI Sets the Ceiling Not the Floor
I was somewhat surprised to read this post from RSnake about how good PCI is for business. I have to...
Alicia Keys should call me
It looks like Alicia Key's MySpace profile was phished then used to host malware. Alicia, I can help...
Review: The Web Application Hacker’s Handbook
McAfee Acquires ScanAlert, I Go WTF?!?!?

Post from: Grumpy Security Guy

HP Corners the Market on Hackers

Interview with Nitesh Dhanjani and Billy Rios, Spies in the Phishing Underground

Mon, 28 Jan 2008 06:30:21 +0000

Both Nitesh and Billy are well-known security researchers that have recently managed to infiltrate the phishing underground. What started as a simple examination of phishing sites, turned into an extr...

Passenger Says He Hacked Windows In New York Taxi Display Screen

Fri, 28 Dec 2007 11:02:19 +0000

A software engineer says he accessed a New York City cab’s video display system files after seeing an error message on the screen.

By K.C. Jones
InformationWeek
December 27, 2007 03:10 PM

A New York City software engineer managed to gain access to the operating system for a touch-screen display available in the back seat of many Manhattan taxicabs and also used it to connect to the Internet. But no sensitive information or critical systems were compromised, according to the display systems vendor. The display is used to present short videos and ads to taxi riders, and can be used to pay the taxi fare with a credit card. A VeriFone Transportation Systems spokesman told InformationWeek Thursday that passengers’ credit card data is encrypted and isn’t stored locally, so it wasn’t compromised. He also said the cab had an outdated modem, used while the city tested the display systems.

Billy Chasen posted photos on his blog earlier this month showing that he accessed a New York City cab’s video display system files after seeing an error message on the screen. The artist and software engineer explained in the blog that he managed to open Internet Explorer, launched the Connection Wizard, selected aSprint (NYSE: S) card for a dial-up connection, and accessed Adobe (NSDQ: ADBE)’s Web site.

Chasen said he opened files and “had full administrative access to everything on the PC.”

“It was not only a security flaw, but people also pay with the screen if they use a credit card,” he said, adding the information could be stored locally.

“What I did was a much bigger problem than GPS tracking,” he said. “You’re essentially giving strangers access to a computer that is shared with hundreds of customers.”

Chasen went on to say that he could have installed software from the Internet.

The VeriFone spokesman, however, said Chasen had merely accessed media files, and passengers could not gain control of sensitive information.

“It’s a Windows-based system, so I could never say never,” he said. “But there is no credit card information stored in the system.”

The spokesman said the meter is integrated into the display system but not reliant upon it, so errors and unauthorized access would not affect meter functioning. He also pointed out that the New York City Taxi and Limousine Commission strictly regulates fares and meters.

“If the meters weren’t functioning right, the TLC would be all over it,” he said.

He also responded on Chasen’s blog, saying VeriFone investigated the incident, the old modem was replaced, and users cannot access editing tools on the system.

The new taxi technology systems, which are required for all New York cabs, generated controversy earlier this year and prompted some cab drivers to protest because they feared they would be monitored and tracked by GPS technology.