The new “bad” is clickjacking where an attacker underlays a malicious web page under a legitimate one, and when you think you’re clicking on one thing, you’re actually clicking on another. We actually use this technique to make it easy to use our phpasndump tool (the Browse button is over top of the entry field so that when you click on it, you’re really clicking on the entry field). There are multiple vectors of attack, including iframes, javascript, and flash. However, they all do the same thing. The article linked above talks about all of the different types and whether there is a patch available. However, the best defense is one that security people have been harping on for a[…]
Category: hacking
James Madison University (JMU) held an open cyber defense competition on Saturday of this past weekend for all current or former students. A few of us here at Gemini had the opportunity to attend and participate as the attackers. It was a great experience for me as well as the students. The students were faced with the scenario of being hired into an already existing IT infrastructure after the entire network team had previously been fired. With a tight deadline and the need to keep standard business operations running, they had to secure all computers/servers and continue to process ‘business requests’ as they came in. The students were given a one hour head start to secure as many devices as[…]
Your company creates a custom web application and deploys it live. I bet it went through some serious security testing, and even the development process had security in mind from the design stage right (it should have). So if all this effort is put into a custom web application, why isn’t the same being done for your company’s blog? Blogs are nothing more than web applications. And unless you created your own blog engine from scratch, you are using some third party solution (WordPress or TypePad). This means you’re trusting the software is free of any vulnerabilities and has been developed with secure coding techniques as well. It’s one thing to insist your developers use secure coding techniques but it’s[…]
Sonoma State University computer science professor George Ledin is teaching his students how to hack and creating controversy in doing it. The companies that make their living fighting viruses aren’t happy about what’s going on in Ledin’s classroom. He has been likened to A.Q. Khan, the Pakistani scientist who sold nuclear technology to North Korea. Managers at some computer-security companies have even vowed not to hire Ledin’s students. … Ledin insists that his students mean no harm, and can’t cause any because they work in the computer equivalent of biohazard suits: closed networks from which viruses can’t escape. Rather, he’s trying to teach students to think like hackers so they can devise antidotes. I’m surprised that such courses aren’t more[…]
Telephones are unsecured, direct access conduits to your users and can traverse passwords, encryption, and any other fancy technical protections. Many people are confident they won’t fall for the “you’ve just won a million dollars, give me your bank account information so we can transfer the money!!” type of scheme. If it’s too good to be true (as they say) it usually is. Put people on the defensive and these tricks work a little better. The phone rings, you pick it up, and the caller identifies himself as an officer of the court. He says you failed to report for jury duty and that a warrant is out for your arrest. You say you never received a notice. To clear[…]
More technical details can be found at this excellent piece at Matasano Chargen. Tiger and Leopard shipped with the Apple Remote Desktop agent (ARDAgent) is set UID as root. To make it worse, it supports AppleScript, and one of the actions it supports is “do shell script”. You can see where this is leading. This type of vulnerability (root access through a SUID root program) is one that I would classify as ancient. Most SUID root programs really look at the code and make sure they’re not doing something this stupid. The solution is easy: if you’re not using Apple Remote Desktop, remove it, or chmod u-s it (removes the SUID bit). However, this vulnerability does need local access, so[…]