Showing posts with label Vulnerable. Show all posts
Showing posts with label Vulnerable. Show all posts
25 Worst Passwords of 2011 [STUDY]
Pro tip: choosing “password” as your online password is not a good idea. In fact, unless you’re hoping to be an easy target for hackers, it’s the worst password you can possibly choose.
Android facial recognition based unlocking can be fooled with photo
Another Android Feature Exploited, Funny that Android facial recognition based unlocking can be fooled with photo . Check out the video below, courtesy of Malaysia’s SoyaCincau :
He said "While some of you think that it is a trick and I had set the Galaxy Nexus up to recognise the picture, I assure you that the device was set up to recognise my face. I have a few people there watching me do the video and if any one of them is watching this video I hope you can confirm that this test is 100% legit.".
Cross Site Scripting Vulnerability in Speed Bit Search Engine
Debasish Mandal, A hacker from India , Found that there is a XSS through JavaScript Injection vulnerability in the Home page of Speed Bit Search Engine.The XSS filter is filtering normal html /script /iframe tags but XSS can be achieved by injecting JavaScript event "onmouseover()".Technical Description is below. Debasish have reported the vulnerability to the Speed Bit Team but haven't yet got any response from their side.
[Check it on Firefox]
Proof Of Concept:
1) Visit this URL http://search.speedbit.com/?aff=grbr" onmousemove="alert(document.cookie)
2) Bring mouse cursor over the hyperlink shown in the image and you should see a POP up box showing the browser cookies.
Submitted By : Debasish Mandal, India.
FACEBOOK:NEW VULNERABILITY FOUND
Hello Friends,
Facebook EXE attachment Vulnerability can Compromise with Users Security
Nathan Power from SecurityPentest has discovered new Facebook Vulnerability, that can easily attach EXE files in messages,cause possible User Credentials to be Compromised .
When using the Facebook 'Messages' tab, there is a feature to attach a file. Using this feature normally, the site won't allow a user to attach an executable file. A bug was discovered to subvert this security mechanisms. Note, you do NOT have to be friends with the user to send them a message with an attachment.
But Nathan Power Find the way to upload EXE . When uploading a file attachment to Facebook we captured the web browsers POST request being sent to the web server. Inside this POST request reads the line:
Content-Disposition: form-data; name="attachment"; filename="cmd.exe"When using the Facebook 'Messages' tab, there is a feature to attach a file. Using this feature normally, the site won't allow a user to attach an executable file. A bug was discovered to subvert this security mechanisms. Note, you do NOT have to be friends with the user to send them a message with an attachment.
But Nathan Power Find the way to upload EXE . When uploading a file attachment to Facebook we captured the web browsers POST request being sent to the web server. Inside this POST request reads the line:
It was discovered the variable 'filename' was being parsed to determine if the file type is allowed or not. To subvert the security mechanisms to allow an .exe file type, we modified the POST request by appending a space to our filename variable like so:
filename="cmd.exe "
Facebook EXE attachment Vulnerability can Compromise with Users Security
Nathan Power from SecurityPentest has discovered new Facebook Vulnerability, that can easily attach EXE files in messages,cause possible User Credentials to be Compromised .
When using the Facebook 'Messages' tab, there is a feature to attach a file. Using this feature normally, the site won't allow a user to attach an executable file. A bug was discovered to subvert this security mechanisms. Note, you do NOT have to be friends with the user to send them a message with an attachment.
But Nathan Power Find the way to upload EXE . When uploading a file attachment to Facebook we captured the web browsers POST request being sent to the web server. Inside this POST request reads the line:
It was discovered the variable 'filename' was being parsed to determine if the file type is allowed or not. To subvert the security mechanisms to allow an .exe file type, we modified the POST request by appending a space to our filename variable like so:
filename="cmd.exe "
IIS 4 exploit
Today i will teach you iis 4 exploit to hack webs based on iis version 4 .. (for windowx xp)
Exploit for iis 4.0 based all websites ... go to run paste dis %WINDIR%\EXPLORER.EXE ,::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\::{BDEADF00-C265-11d0-BCED-00A0C90AB50F}
and press enter
and then make a new web folder .. and give the iis 4.0 based web eg http://axoneservices.com/
and u will be in the site .. copy and paste ur shell or defaced page ... and u r in the site
BlackBerry Hacked via Drive-By Download at Pwn2Own !
BlackBerry OS fell during the second day of the Pwn2Own hacking competition as a result of a drive-by download attack that chained together several exploits.
The trio that managed to hack RIM's mobile operating system, Vincenzo Iozzo, Willem Pinckaers and Ralf Philipp Weinmann, exploited two vulnerabilities in the open-source WebKit layout engine in order to do it.
The attack was launched from a specially crafted web page that stole information like contacts and images from the device and also wrote a file to the storage system.
The hackers chained together an exploit for an information disclosure bug and one for an integer overflow vulnerability, but what's most impressive is that they did it without any documentation.
They didn't have access to any debugging tool, like the ones available for other systems, that could have helped them determine how the attack code interacts with the system. Instead, they had to rely on exploiting a separate bug to read the device's memory.
"The BlackBerry is a system no one knows anything about. We know there’s a browser and a Java virtual machine. We had to assume that once we take over the browser, we can get further into the system," Vincenzo Iozzo told ZDNet.
The hackers' job was easier because BlackBerry OS doesn't have ASLR or DEP, two security mechanisms that would have made vulnerability exploitation of a lot harder.
RIM's director of security response, Adrian Stone, who was at the CanSecWest security conference where Pwn2Own is taking place, confirmed that the company is looking to add these technologies in future versions.
Apple, for example, has already implemented native ASLR in the new iOS 4.3 released two days ago. That update did not make to the contest though, because all configurations were frozen two weeks in advance.
The attack was launched from a specially crafted web page that stole information like contacts and images from the device and also wrote a file to the storage system.
The hackers chained together an exploit for an information disclosure bug and one for an integer overflow vulnerability, but what's most impressive is that they did it without any documentation.
They didn't have access to any debugging tool, like the ones available for other systems, that could have helped them determine how the attack code interacts with the system. Instead, they had to rely on exploiting a separate bug to read the device's memory.
"The BlackBerry is a system no one knows anything about. We know there’s a browser and a Java virtual machine. We had to assume that once we take over the browser, we can get further into the system," Vincenzo Iozzo told ZDNet.
The hackers' job was easier because BlackBerry OS doesn't have ASLR or DEP, two security mechanisms that would have made vulnerability exploitation of a lot harder.
RIM's director of security response, Adrian Stone, who was at the CanSecWest security conference where Pwn2Own is taking place, confirmed that the company is looking to add these technologies in future versions.
Apple, for example, has already implemented native ASLR in the new iOS 4.3 released two days ago. That update did not make to the contest though, because all configurations were frozen two weeks in advance.
MHTML vulnerability under active exploitation !
We’ve noticed some highly targeted and apparently politically motivated attacks against our users. We believe activists may have been a specific target. We’ve also seen attacks against users of another popular social site. All these attacks abuse a publicly-disclosed MHTML vulnerability for which an exploit was publicly posted in January 2011. Users browsing with the Internet Explorer browser are affected.
For now, we recommend concerned users and corporations seriously consider deploying Microsoft’s temporary Fixit to block this attack until an official patch is available.
To help protect users of our services, we have deployed various server-side defenses to make the MHTML vulnerability harder to exploit. That said, these are not tenable long-term solutions, and we can’t guarantee them to be 100% reliable or comprehensive. We’re working with Microsoft to develop a comprehensive solution for this issue.
The abuse of this vulnerability is also interesting because it represents a new quality in the exploitation of web-level vulnerabilities. To date, similar attacks focused on directly compromising users' systems, as opposed to leveraging vulnerabilities to interact with web
services.
News Source : Googleonlinesecurity
To help protect users of our services, we have deployed various server-side defenses to make the MHTML vulnerability harder to exploit. That said, these are not tenable long-term solutions, and we can’t guarantee them to be 100% reliable or comprehensive. We’re working with Microsoft to develop a comprehensive solution for this issue.
The abuse of this vulnerability is also interesting because it represents a new quality in the exploitation of web-level vulnerabilities. To date, similar attacks focused on directly compromising users' systems, as opposed to leveraging vulnerabilities to interact with web
services.
News Source : Googleonlinesecurity
EgY SpIdEr ShElL : Shell strongest in the history the hacker !
Sites get hacked every day. The bad guys often install a toolkit to control remote servers effectively. Here is one called EgY SpIdEr ShElL:
When logging in, you get a quick overview of the machine with what services are running, as well as some hardware specs.:
Brute force attacks:
HTTP form cracks:
Encoding:
Database queries:
SQL injection tool:
The origin of this toolkit seems to point to Arabic countries. It is just one of many similar hack shells that criminals use. A future blog post about other tools might be necessary
WD TV Live Hub Compromised - Multiple Vulnerabilities Found By Dr. Alberto Fontanella
Dr. Alberto Fontanella found on (Western Digital) WD TV Live Hub appliance with the last firmware installed (2.06.10) and 3 exploits to get admin password, deface appliance and get root shell:
Author: Dr. Alberto Fontanella
E-mail: itsicurezza<0x40>yahoo.it
Web: www.fulgursec.com
Vendor: Western Digital
Vendor Web: www.wdc.com
Version: WD TV Live Hub <= 2.06.10 (firmware) ALL VERSIONS
Type: Appliance
Issues: Storage Anonymous Access, Full Path Disclosure, Bypass Authentication Schema, Appliance Command Execution, DoS, OS , Command Execution, Root Shell ;-)
* AF - Owning WD TV Live Hub
FILE: AF-Owning_WD_TV_Live_Hub.pdf
INFO: Paper that shows all issues found on WD TV Live Hub and how use it to get Root!
* AF - PoC/Exploit WD TV Live Hub Get Admin Password
FILE: AF-WD_TV_Live_Hub_password.sh
INFO: Exploit (Bypass Authentication Schema) to Get Admin Password of Web Console
* AF - PoC/Exploit WD TV Live Hub Deface
FILE: AF-WD_TV_Live_Hub_deface.sh
INFO: Exploit (Appliance Command Execution) to Deface WD TV Live Hub
*AF - PoC/Exploit WD TV Live Hub Get Root Shell
FILE: AF-WD_TV_Live_Hub_root_shell.sh
INFO: Exploit (OS Command Execution) to Get Root Shell
Download all Files Here
War Texting : Hackers Unlock Car Doors Via SMS
Don Bailey and Mathew Solnik, Two hackers have found a way to unlock cars that use remote control and telemetry systems like BMW Assist, GM OnStar, Ford Sync, and Hyundai Blue Link. These systems communicate with the automaker’s remote servers via standard standard mobile networks like GSM and CDMA — and with a clever bit of reverse engineering, the hackers were able to pose as these servers and communicate directly with a car’s on-board computer via “war texting” — a riff on “war driving,” the act of finding open wireless networks.
Don Bailey and Mathew Solnik, both employees of iSEC Partners, will deliver their findings at next week’s Black Hat USA conference in Las Vegas in a briefing entitled “War Texting: Identifying and Interacting with Devices on the Telephone Network.” The exact details of the attack won’t be disclosed until the affected manufacturers have had a chance to fix their systems, and the hackers are not expected to reveal at the conference which on-board systems they have successfully hacked, but to be honest it doesn’t really matter: if two systems have been cracked (and in just a few hours no less), then it’s likely that other on-board, remote control systems are also vulnerable to the same attack vector.
Software that lets drivers unlock car doors and even start their vehicles using a mobile phone could let car thieves do the very same things, according to computer security researchers at iSec Partners. Don Bailey and fellow iSec researcher Mathew Solnik say they've figured out the protocols that some of these software makers use to remote control the cars, and they've produced a video showing how they can unlock a car and turn the engine on via a laptop. According to Bailey, it took them about two hours to figure out how to intercept wireless messages between the car and the network and then recreate them from his laptop. Bailey will discuss the research at next week's Black Hat conference in Las Vegas, but he isn't going to name the products they've hacked — they've looked at two so far — or provide full technical details of their work until the software makers can patch them.
Save this Page
