Infosec-Soapies
Dont look now, but it seems they broke the Interwebs again..
Those pesky hackers!
Alex Sotirov (of heap feng shui fame, famous for breaking everything from Vista, to web browsers, to facebook) and Jacob Applebaum (of cold-boot attack fame, and more importantly of “knuth is my homeboy” fame) will be talking in a few hours at the 25c3 conference in Germany and by all accounts its going to be an “Internet Breaker”.
There is a fair bit of speculation on the nature of the bug (though most people some confident that its routing protocol related) and HD Moore has blogged that the pair have sought legal advice pre-publishing.
Wired Article on DNSGate..
Wired magazine has covered the DNSGate saga with full dramatic details like: “never, ever repeat what you just told me over a cell phone“.
Its a quick read, and worth it for the classic line: “The DNS community had kept the secret for months. The computer security community couldn’t keep it 12 days”
“Unix Terrorist” in trouble over TJX ?
Anyone who was around for Defcon-10 will have an opinion on the infamous Gobbles-Silvio-UnixTerrorist talk in which mail spools where published and everyone was slammed [1]
According to mumble on the Interwebs (and a comment from RiskyBusiness) it appears as if the Stephen Watt who allegedly “modified and provided a “sniffer” program used by the conspirators to monitor and capture the data crossing corporate computer networks” == Unix Terrorist..
It’s not clear the extent of Watts involvment with the breakin, but it does send a cold shiver down the spine of anyone who puts out tools / software..
Sarah Palin, a yahoo email account, and something more shocking…
By now everyone knows that John McCain’s running mate Sarah Palin had her yahoo email account hacked. I guess a presidential candidate using yahoo for govt. related email was about as shocking as Sarah Palins nomination as possible future president ((unless of course you have ever heard of other govt. officials using yahoo/gmail/hotmail for serious business)(inside joke for south africans!)).
People have been talking about secure password resets for a long time [1] and this was pretty shocking all around..
these tubes are quick
Kaminsky’s thunder has all but evaporated into a fine mist, and Ptacek has gone all silent. In the meantime, the MetaSploit crowd put their heads down and produced:
http://www.caughq.org/exploits/CAU-EX-2008-0003.txt
DNS poisoning for the masses.
(If anything ever deservered the tag ‘infosec-soapies’, this would be it!!!)
What? no comment on the DNS thing ??
Mostly we have stayed silent, because too many people have commented too much already.. It was interesting however how Ptacek was quite deftly forced to eat his words by a Dan Kaminsky phonecall..
The “ill tell everyone all during my Vegas talk” angle is an obvious way to pack the room.. but hey, cheaper tricks have been pulled to pack rooms in the past.. [and if anyone didnt need help packing a room, its dan.. he has a cult following]
Carpet Bombing and eating Crow…
The recent Safari Carpet Bombing bug reported by Nitesh Dhanjani and ignored by Apple had all the makings of an egg-on-face incident. We were discussing it over foosball, and the obvious consensus was “if a line starts with: “thats not exploitable, its only..” then odds are you are wrong..”
But.. lots of people quicker and smarter than me [1, 2, 3] blogged (or twittered) about why this was a silly approach for apple to take..
If you run Debian (or a Debian Derivative, like Ubuntu)…
Then you probably should get on this one… [Problems with Random Number Generator]
While it looks like an arb openssl bug, 2 seconds of reading should get you to:
-snip-
It is strongly recommended that all cryptographic key material which has
been generated by OpenSSL versions starting with 0.9.8c-1 on Debian
systems is recreated from scratch.
&&
Affected keys include SSH keys, OpenVPN keys, DNSSEC keys, and key
material for use in X.509 certificates and session keys used in SSL/TLS
connections.
-snip-
The Peltier Effect – Year in Review..
Peltier and Associates have released their massive “Peltier Effect – Year in Review 2007“.
The collection comes in at a whopping 156 pages from a wide array of authors so there should be somethign to read in it for everyone..
Our short article: “2007 – The Year Timing Attacks Made a Comeback” comes in on page 43 (or 52 depending on if you believe the page numbers or your pdf reader). Other contributions include a foreword by Marcus Ranum, and articles from Dave Aitel, Max Caceres and Ivan Arce.. humbling company..
SNMP Joins Dark Side in New XSS Attack
-sigh- the topic is stolen directly from the [DarkReading Article]
-snip-
Itâ€s yet another new spin on a pervasive attack — this time using the old standby Simple Network Management Protocol (SNMP) to stage cross-site scripting (XSS) attacks.
-snip-
-sigh- a little while back while doing a pen-test on a 1U device, we found that a well poisoned SNMP string could easily result in XSS and even SQL Injection attacks.