Firewall hack

Ever encountered a system where the group policy prevents you from enabling the firewall? Sounds lame and ironic but it happened to me. I feel naked and insecure without a host-based firewall so I had to figure out how to crack the policy and turn on the firewall.
Hack to enable Windows Firewall. Here are the instructions.

1. Click "Start" then "Run". Type in "regedit".
2. Back up your registry by clicking "File" then "Export".
   
3. Drill down to "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\" and delete the key "EnableFirewall".
4. Drill down to "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\" and delete the key "EnableFirewall".
5. Reboot Windows, login and turn on Windows Firewall.

Viola!!!

Nouseragent

Paros Proxy is a pretty nifty proxy tool for application security testing. I use it frequently to intercept interactions (ie. requests and responses) between my browser and sites I want to scrutinise. What I didn't realise was that Paros would attach its name to the User-Agent header when submitting my browser's requests. This is not desirable if you want to avoid hackers being alerted to your interactions with their compromised site.
To counter this, the User-Agent header has to be modified before sending out the request traffic. The permanent solution is to instruct Paros to stop adding its name into the header by adding the switch "-nouseragent" after the Paros command.
Thanks to w01f for this tip.

Innocent???

U-Toys is one of my toy suppliers. I recently bought my Green Lantern action figure from them. I didn't know their website address so I decided to google it. Hmmmmmm? My Firefox plugin, Finjan SecureBrowsing, flagged malicious activity on this site.

Better play it safe. I fired up my Virtual Machine and proceeded to the site. Pop-ups blocked by Firefox but either wise nothing suspicious happening.

How about I try allowing the pop-ups? Lo and behold!!! A strange file mysteriously appears in my root directory. Submitted this executable file to VirusTotal and it was discovered to be a Trojan. Scary isn't it? Only 9 out of the 40 hosted AV engines detected it as malware. My hypothesis is that the hacker injected the banner ads into the website. The ads point to another site that drops the Trojan onto the victim's machine.

I ran through the same sequence again... this time on another machine with Antivir AV engine installed and updated. Antivir was able to block the malware from being injected using its heuristic scanner. Powerful!!! The Trojan's filename is randomly generated btw because the filename keeps changing when I repeat the injection multiple times.
I've contacted my toy supplier but he is unwilling to take down the site and doesn't know how to rectify the problem. I've offered my security consulting service in exchange for toys but was turned down. Out of goodwill, I offered a few remediation options but he rejected them.
Morale of the story? Be wary when surfing the dangerous web... you never know which site hosts malicious content no matter how innocent it looks.

File carving

File carving (aka carving) is defined as "the practice of searching an input for files or other kinds of objects based on content, rather than on metadata... for recovering files and fragments of files". The input from a digital forensic perspective is either an image of a disk or packet dumps.
Foremost is the tool of choice for forensic analyst wanting to recover evidence from disk images. tcpxtract is a tool designed for extracting files from captured network traffic. I installed tcpxtract onto my Ubuntu 8.10 system. I captured the packets of an FTP session where I transferred an image from one host to another. I ran tcpxtract against the pcap file to extract the said transferred image. Viola!!!

The high res version of this demo can be downloaded here.

Infected?

I've encountered systems that were so badly infected that the OS could not boot up properly. In most cases, I would recommend a full wipe before reinstalling the OS but there may be critical data still resident on that drive. That is where a rescue CD might be useful. F-Secure and Avira are 2 AV vendors that offer free rescue CDs for that purpose.
I tested the F-Secure rescue CD. You basically download their ISO file from their website, burn the ISO into a bootable CD and boot up the infected system from the CD. The bootable Linux OS has a built-in F-Secure AV engine that will prompt you to update its virus detection signatures*. Next, you choose the drive/partition to scan. It will start scanning the selected drive/partition and rename files detected as malware (by adding .virus).

* You need to have Internet connectivity to obtain the latest virus detection signatures.
The high res version of this demo can be downloaded here.

Dban

Dban is a utility that permits you to securely wipe the contents of entire hard drives. You can use it to wipe data off the corporate laptop that you are returning to your employer, a hard drive that you plan to dispose off or your hard drive that you plan to reinstall the OS on because it is infected with malware. You can download the CD, DVD, diskette or USB flash drive versions for whatever your needs.
Boot up using Dban. When you see the menu, type in "autonuke" at the boot prompt. This is the easiest mode to use. Once you've pressed "Enter" key, Dban goes about its business and does not require any further interaction from the user. Viola! Simple as ABC. Patience is required as wiping is not a speedy process. Time taken to wipe a whole drive varies depending on the wiping method selected and the size of the drive.

For advanced users, you may opt for other wiping methods by pressing on "F3". The DoD 5220.22-M method and the Gutmann* methods are quite time consuming.

Active computer forensic guru conducted independent research and arrives at the conclusion that a single drive wipe makes data impossible to recover.

* From personal experience, Dban took 2 days to wipe my 40GB hard drive using the Gutmann method.

TKIP vs AES

Almost everyone I know deploy wireless networks at home and I'm not surprised because wireless is convenient. What wasn't explained to them by vendors is that wireless is less secure and reliable as compared to wired connections.
Reliability isn't high on the list of priorities for home users but security should be. I just found out what the difference between TKIP and AES encryption options was. TKIP was offered as a short-term solution to improve upon the weak security offered by WEP. AES is the more robust and preferred choice. However, older hardware may not offer AES because it requires more resources for cryptographic computations thus some vendors make their equipment backward compatible with TKIP.
Utilise AES when using either WPA or WPA2 in your environment. However, AES is not supported by all hardware and users might still be forced to rely on TKIP. In light of hardware limitations, the workaround solution is to lower TKIP renewal timings to any value lower than 120 seconds.

Social engineering at work

w01f sent me a malicious file that tricks victims into installing malware using social engineering. I tested it in a virtual machine and it is simple really.
Victim plays MP3. User is informed that a Codec is needed to listen to the song and is directed to a website to download the missing software. Victim installs "Codec". Wham!!! Victim trojaned.

If you had a decent AV software installed and updated, it would have prevented you from downloading the malware. However, there are crappy AV engines that failed to detect this malicious executable.

Don't be fools people! Always question every piece of software you are prompted to install.

Ophcrack

Windows stores user passwords in hashes. Hashing is a one way transformation of text and thus Windows passwords can be cracked by matching hashed passwords with rainbow tables.
Ophcrack is an open source program that cracks Windows passwords. Burn Ophcrack into a bootable CD and boot up your target system with the CD. Ophcrack will dump the Windows hashes and start matching the dumped hashes against its rainbow tables.

In this specific scenario, the caveat is that you need physical access. There are tools that perform offline cracking. Cracking passwords can be time consuming but it doesn't alert the admin or user as you do not change the original password. Did you know that all it takes to change the user password in Mac OS X is to boot up using the installation CD???
The high res version of this demo can be downloaded here.

Magic bytes

File type detection is crucial when attempting to block specific file types from being downloaded in a corporate environment for security or legal reasons. File extension renaming is a rudimentary method of bypassing security filters but yet it is surprisingly still effective in certain scenarios. Ever tried sending an executable file over the MSN network? The Windows Live Messenger client will display an error message "The file you attempted to send has been detected as potentially unsafe and was not sent.". Have you tried renaming .exe to .doc? OMG... it works!!!
Perfect example why filtering by file extension name is weak. The more sophisticated and effective method of file type detection is "magic bytes" matching. Certain files can be uniquely identified by either their file header or file header and file footer combination. An executable file will have the hex values of "4D 5A" or its ASCII equivalent of "MZ" at the beginning of the file.

PDF files on the other hand can be identified by their file header and footers.

Don't believe me? Give it a go. Download HxD Hex Editor to view files in Hex format. Try renaming file extensions and you will see that the file contents do not change.

Session hijacking

Imperva defines session hijacking as "the act of taking control of a user session after successfully obtaining or generating an authentication session ID... involves an attacker using captured, brute forced or reverse-engineered session IDs to seize control of a legitimate user's Web application session while that session is still in progress".
I demonstrate session hijacking using a combination of tools called Ferret and Hamster as well as my own private wireless network. No neighbours or wireless users were harmed during this recording. The use of Internet Explorer is to simulate another party (ie. the "victim") sharing the same open wireless network (eg. free wireless at Starbucks). Ferret sniffs the unencrypted traffic in the air and collects useful information into a text file. From Firefox, I access Gmail to show the login page and verify that I did not cheat by logging in earlier. Hamster is then utilised to present web session-related information in the form of hyperlinks which I click to present me (ie. the "attacker") with easy access to active sessions. Viola! You have been hijacked!

The higher res version of this demo can be downloaded here.

To avoid being hijacked, avoid logging into websites that do not support HTTPS on open wireless networks. If you don't want to be snooped on, don't use public networks period.