Security News (106 Posts)

<< Next - First ... 4 5 6 7 8 ... Last - Previous >>

Hackfu2015 Challenge 7 - Solution

#106 - Posted on 12 May 2015 - Author: SM - Category: Challenges, Security

This is part of my write up from the Hackfu 2015 Security Challenge.

The third and last challenge I solved was surprisingly very easy, but there might have been more to it...

The instructions given were:

  • An ELF Binary file: shipbinary
  • "Your mission is to analyse the executable binary and find a way to get it to run to its completion so that it ends up spitting out the access code for the ship's central server."

    • Below is how I solved that challenge:
    We first run the following command to see all the printable/ASCII strings from the binary.
    > strings shipbinary
    Below is an extract of the most interesting result from the above command.
    Enter Decryption Code:
    burnthelandandboilthesea
    Code Accepted.
    Establishing Connection to Planet Abaddon...
    out.txt
    123.123.123.1 -c 1 | tail -1| awk '{print $4}' | cut -d '/' -f 2     ...
    >>[READ MORE]

    Hackfu2015 Challenge 5 - Solution

    #105 - Posted on 12 May 2015 - Author: SM - Category: Challenges, Cryptography, Security

    This is part of my write up from the Hackfu 2015 Security Challenge..

    The second challenge I solved was in fact quite easy because I solved a similar one for the SANS Summer challenge in 2014 (where it took me much longer to solve the first time I came across this type of steganography!)

    The instructions given were:

  • An audio file to analyse
  • There is a hidden message in it, find it!

    • Below is how I solved that challenge:
  • Listening to the audio file only produces white noise.
  • Looking for strings added to the file does not produce anything.
  • Looking for hidden data using stenography extraction tool such as steghide does not produce anything either.

    • But, If you load the file in a windows software such as Sonic Visualizer, add a layer to show a Spectrogram ...
    >>[READ MORE]

    Hackfu Challenge 2015 - Solution for Challenge 1

    #104 - Posted on 11 May 2015 - Author: SM - Category: Challenges, Cryptography, Security

    MWR ran a Security Challenge last April, unfortunately I only found out about it 3 days before the dead line! I still managed to solve 3 out of the 7 challenges and really enjoyed them.

    The first challenge was especially interesting, as I like cryptography. This was a tough one!!!

    The instructions given were

  • You are invited to a game of Poker but must find the password
  • You find a note with written "Pocket RC4"
  • You find a deck of card ordered from Ace to King with the following "couple" suits: {Diamond, Club}, {Heart and Spade}. This mean AD, AC, 2D, 2C....KH, KS
  • You find a note with the following written on it: "WEMUSTFOLLOWTHEWHITERABBITANHXJRAAZEBYYOMNWPBKGZOGY"

    • That's pretty much it! Below is how I solve this challenge and cracked the code:

    I used information on PocketRC4 f...
    >>[READ MORE]

    One more update to the Security Onion Guide

    #103 - Posted on 11 May 2015 - Author: SM - Category: Guides, IDS, Misc, Security

    We have updated once more our Security Onion Installation Guide with a few tweaks regarding setting up BRO emails and SSH.
    There is also a new PDF version, using an updated template, available from the download section .

    ...
    >>[READ MORE]

    Updated Security Onion Guide

    #102 - Posted on 5 April 2015 - Author: SM - Category: Guides, IDS, Misc, Security

    Last week, Security Onion repository moved from Google Code to Github. We have now updated our Security Onion Installation Guide with the new links.
    Basically, replacing the base part of each link from the old reference
    "https://code.google.com/p/rest_of_the_link]"
    to
    "https://github.com/Security-Onion-Solutions/rest_of_the_link]"

    If you are looking for "issues", not only do you need to replace the base reference as mentioned above, but you also need to remove the "detail?id=" at the end of the URL.
    For example:
    https://code.google.com/p/security-onion/issues/detail?id=488 (does not work )
    Becomes
    https://github.com/Security-Onion-Solutions/security-onion/issues/48...
    >>[READ MORE]

    How to setup PIWIK to track visitors' downloads

    #101 - Posted on 28 March 2015 - Author: SM - Category: Guides, Security

    PIWIK is a an amazing Open-Source Web Analytics platform which is a good alternative to http://www.google.com/analytics/ as it provides full control to your data and more details (i.e.: full IP addresses).
    You have 3x hosting options:

  • Use their cloud service. (More info here)
  • Host it yourself online: at the back of your web server or on a different/dedicated server. (More info here)
  • Host it offline, and manually import your apache logs. (More info here )

    • The advantage of hosting it online is that you can use a php/javascript trackers within your web pages producing more information on your visitors (screen resolution, plugins, etc)
    It also allows you to do certain "tricks", such as tracking who downloads a specific image as ...
    >>[READ MORE]

    How to setup Security Onion on a home network with Splunk, email alerts and some basic tuning

    #100 - Posted on 23 March 2015 - Author: SM - Category: Guides, IDS, Security

    Entry Last updated on the 11th of May 2015
    a PDF version is also available to download here

    Security Onion (SO) is a great open source project created by Doug Burks.
    It is a Linux Distribution based on Ubuntu and bundled/configured with all the tools you need to get a powerful, and free, Network Security Monitoring system (NSM). It can be used to monitor your network traffic for suspicious activities and malware.

    This guide is aimed at people who quickly want to get started with SO with the following basic functionalities:
  • Getting an understanding of what Network and Server setup are required
  • Going through a basic SO installation
  • Getting basic understanding on how to tune Snort and remove false positives
  • Getting regular reports and speci
    • ...
    >>[READ MORE]

    Fix for compiling VMwaretools 9.9.2 on kernel 3_18+

    #99 - Posted on 15 March 2015 - Author: SM - Category: Guides, Security

    We recently encountered some errors when trying to recompile the VMwaretools on Kali (kernel 3.18) and Security Onion (Kernel 3.2):

  • error: implicit declaration of function ‘smp_mb__after_clear_bit’
  • error: ‘struct dentry’ has no member named ‘d_alias’

    Those errors meant it was not possible to share files between the Host OS and the virtual machines, as compilation was failing in the vmhgfs-only directory.

    Below are a set of instructions to fix those issues.
    Please note the following was Tested with VMwaretools-9.9.2-2496486.tar.gz, and you need to do this as "root"
  • In Fusion/VMWare select reinstall VMwaretools - This will mount a virtual VMWare CDROM
  • Go to that CDROM and copy the VMwaretools tar.gz file onto your /tmp directory.
  • Unmount the CDROM (you may not need to do this, but we did have have issue once with the CDROM still mounted).
  • Uncompress the tar.gz file using "tar xvzf"
  • Go to /tmp/vmwa
    • ...
    >>[READ MORE]

    iOS Backdoors

    #95 - Posted on 24 July 2014 - Author: SM - Category: Hacking, Security

    In the last few days there has been an increasing noise related to some iOS backdoors. Apple does not deny they exist, but contests how they can be used.

    This is not new, and the security researcher who presented his findings did highlight that, it is likely related to methods being used by certain forensic software sold to law enforcement.
    What is “concerning” is the following:
    – These backdoors are actively maintained and developed by Apple, how much more data will they allow to be extracted from iOS device in future;
    – Those backdoors provide access to SMS, Contact, and other potential sensitive data on the phone; they also allow to bypass full disk encryption. This highlight the fact that unless you phone is off, the data on your phone is no longer encrypted per say, but only protected by access control (PIN);
    – If it can be used by law enforcement, it can be used by “greyer” parties ...
    >>[READ MORE]

    Critical Infrastructure and Cyber attacks

    #94 - Posted on 3 May 2014 - Author: SM - Category: Security

    I recently came across an article on a UK newspaper, the Guardian, about Mt Kaspersky predicting a riot. Well, not exactly. He is predicting a major cyber terrorist attack on UK soil which will disrupt major critical infrastructure.

    http://www.theguardian.com/technology/2014/may/01/eugene-kaspersky-major-cyberterrorist-attack-uk

    I find this interesting, not because it is new, it isn’t. I find it interesting because there has been an increasing media visibility and attention to this topic in the last few years. By the way, I am also a big believer of “it will happen soon”. The internet of things is not a secure affair.

    And I also find it quite a coincidence that Mr Kaspersky is warning us about a real life Die Hard 4 risk scenario as only yesterday I came across that following article:

    ...
    >>[READ MORE]