Entries by Dominic White

Yeah! If you were wondering why I wanted to know who discovered SQL injections, it was to nominate a "Pwnie for Mass 0wnage". And it was accepted:

• SQL injection in more than 500,000 web sites

  Discovered by: Rain Forest Puppy back in 1998

  SQL injection attacks are not new, but this year we saw an upsurge in the number of automated attacks against vulnerable websites. Reportedly more than half a million websites were compromised.

Although I see they went all conservative on the numbers (500k, *psccht*). ShadowServer has nearly 500k from the nihaorr1.com injection alone. Anyone with contacts please correct them.

Posted by Dominic White

Schneier once proposed a vulnerability life cycle in a Crypto-Gram newsletter. He was wrong. During the time of writing my thesis, there were several important pieces of research no-one had put together to come up with a 'more correct' vulnerability life cycle. Given some recent discussions between Symantec and Verizon, I thought I would provide this is a more accessible format that a previous presentation I did on the subject, so that I could refer to it later.

The benefits of having an understanding of the life cycle, is that it provides a model to 'predict' the behaviour of various role players (e.g. bad guys, vendors and administrators) and understand how that behaviour impact on important parts of the risk management equations such as vulnerability, threat and impact. This is an important building block of any threat model.

The detail after the jump.

Continue reading "Vulnerability Life Cycle"

Posted by Dominic White

Some older versions of SELinux and OpenSSH compiled to support it allow you to log in with an arbitrarily chosen SELinux role. You'll need a valid account, and some fairly undefined conditions, but the attack is:

Haven't seen a (potential) stuff up like that since the MIT Kerberos telnet daemon flaw (which was significantly worse). I'd like to think that people who've gone to the effort of setting up SELinux also patch regularly. Source, milw0rm.

I am interested in this because it is dreadfully simple, has some weird implications for how SSH and SELinux interact, and there is scant information about this. Maybe a few more eyes can uncover something.

Disclaimer: I haven't tested this. The author only tested it on a limited subset and it didn't work on up-to-date distros.

Update: Explained my motivations and authority (or lack there of) of the exploit thanks to foobar's comments.

Posted by Dominic White

I never remember how to do this, so for my own personal blog-memory:

rsync --partial --progress --rsh="ssh -p <remote ssh port>" <from file> <partially downloaded file>

• The --rsh parameter can contain all of your normal ssh command line-fu such as keys, options, ports etc. (Who runs public ssh on port 22 these days anyway?)
• The <from> and <to> follow the normal SCP format of <username>@<hostname>:<filename> or just <filename> for the local copy.

Posted by Dominic White

Rain Forest Puppy (rfp) in a merry Christmas of an article entitled "NT Web Technology Vulnerabilities", published in Phrack Magazine, Volume 8, Issue 54 on December 25th, 1998. He didn't actually call it SQL injection yet, that honour either goes to SANS or Chip Andrews in 2001. Source, Litchfield.

Here's the beginning of his summary, from the section entitled "ODBC and MS SQL server 6.5":

- WHAT'S THE PROBLEM? MS SQL server allows batch commands.

- WHAT'S THAT MEAN? I can do something like:
    SELECT * FROM table WHERE x=1 SELECT * FROM table WHERE y=5
Exactly like that, and it'll work. It will return two record sets, with each set containing the results of the individual SELECT.

- WHAT'S THAT REALLY MEAN? People can possibly piggyback SQL commands into your statements. Let's say you have:
    SELECT * FROM table WHERE x=%%criteria from webpage user%%
Now, what if %%criteria from webpage user%% was equal to:
    SELECT * FROM sysobjects
It would translate to:
    SELECT * FROM table WHERE x=1 SELECT * FROM sysobjects

Posted by Dominic White

It's official, I'm going to Black Hat and Defcon this year. I'm very excited. A *huge* thank you to the SensePost guys who are sorting me out only proper. Make sure you go, to, their, training. We've also pulled together a fairly decent Deloitte contingent.

I'll be there from the 29th of July to the 11th of August if all goes off according to plan. Give me a shout if you want to meet up, or if you have invitations to sexy parties.

Posted by Dominic White

If you've decided you want to make better coffee, here are my tips for the changes that will yield the biggest results. These aren't comprehensive, just some quick tips for quickly making better coffee.

1. Don't use instant, use proper Arabica grounds.
2. Espresso is the best, then French press, then percolator. A Moka Express or Brikka are quick ways to get into espresso.
3. Use hot milk. This makes a big difference in taste, 30-40s in the microwave should do it. A French Press can be used with hot milk to make decent froth for cappuccino too.
4. Grind your own beans. A grinder is cheap, and freshly grinding your own beans just before you make a cup makes a subtle increase in flavour. Remember to store your beans in an airtight container in a cool dry place (not the fridge).

Posted by Dominic White

Posted by Dominic White

This will be fun to watch. Dan Kaminsky has sort-of published  not-so-sekret ways to break DNS. Patches have been released to make things more random. "Full" disclosure at BlackHat.

From ISC:

"The method used makes it harder to spoof answers to a resolver by expanding the range of UDP ports from which queries are sent, thereby increasing the variability of parameters in outgoing queries."

I laughed with mirth and glee at the Emergent Chaos comment:

"DJBdns is in fact not affected as DJB had already implemented port randomness even though he didn't know it was an issue."

This means *all* DNS (except DJBdns) is vulnerable, many vendor patches to follow. Although, DNSSEC is the *right* answer.

• CVE
• CERT VU
• Microsoft

Posted by Dominic White

The South African Police Services have released the crime stats for the last financial year. I still need to wrap my head around the numbers, as many of the categories don't seem discreet, or intuitive. However, I think the executive summary contains some good insight into the 'threat landscape'. It also backs up several of my 'gut feel' assertions about crime in SA. However, as Russell points, there may be an independence issue, as the report is "written by the guys whose job is on the line", and I haven't found any information on how the stats were independently verified. I've culled some sections from the executive summary and given them my own headings, formatting and order. Whatever your take on crime in SA, these stats are a good read, and certainly more likely to be accurate, even with bias, than the eight year old drivel on Wikipedia.

Continue reading "SA Crime Stats 2008"

Posted by Dominic White

Microsoft has released a security advisory detailing three ways to respond to the SQL injection attacks. This advisory doesn't covery a patch, just three tools:

1. HP Scrawlr is a light weight version of HP's WebInspect that will look for SQL injection flaws. I love that they used the Bobby Tables XKCD comic.
2. A new version of UrlScan (3.0 beta) the IIS version of mod_security.
3. A source code analyser which will identify SQL injection vulns, although it currently only works for ASP and not ASP.NET.

Posted by Dominic White

Posted by Dominic White

Over the last few weeks, we have seen a set of incredibly uncomplicated and simple attacks effectively compromise several hundred South African web pages, and several million internationally. Many of the South African sites compromised were important; including major media organisations, several government institutions, large mining houses and even one information security company, who still have not removed the pie from their face. The intention of the attacks was to use the compromised web pages to infect visitors with a variety of malware, but most commonly, a trojan which attempts to steal as many passwords as it can, including specific references to some internet banking sites.

The response to the incident from both consumers and the affected companies seems to indicate that when it comes to the web in South Africa, nobody cares.

Continue reading "Major SA websites hacked by China - nobody cares about the Web"

Posted by Dominic White

Posted by Dominic White

I've been ranting about the SQL injections for a while now. While infecting your visitors with malicious software semi-silently generally doesn't put the pressure on the right people (i.e. the externality lies on the infected user not the infecting business), having your organisation blacklisted by Google shifts that externality. Here are the screenshots of Google warning me that the South African Broadcasting Company (SABC) may harm my computer. Check it yourself by googling 'sabc'. At the time of writing, the SABC had fixed the page.

Continue reading "SABC Blacklisted by Google"

Posted by Dominic White