Chapters In Web Security

PurpleAI - Offensive Cyber AI

noreply@blogger.com (Raviv Raz) — Mon, 23 May 2022 09:19:00 +0000

PurpleAI began as my thought experiment a few years back. Could the perfect virus be created using Artificial Intelligence? A weapon so powerful that it could be trained to overcome any and all adversarial defense lines, infiltrating large-scale IT infrastructure and obtaining its mission objectives autonomously. It took a national Cybersecurity consortium of the Netherlands’ largest financial institutions, known as PCSI, and the national center for advanced research, TNO, to turn PurpleAI into a fascinating journey. Through collaboration of brilliant scientists, engineers and Cybersecurity experts from both Blue and Red teams we are advancing a new domain of offensive Cyber AI. Our first proof-of-concept revolves around post-exploitation Windows Privilege Escalation:

You may learn more about the background and incentives behind PurpleAI in this interview with ABN AMRO Bank Chief Information Security Officer, Dr. Martijn Dekker:

Apache Struts Remote Command Execution explained

noreply@blogger.com (Raviv Raz) — Mon, 23 May 2022 09:01:00 +0000

Introduction

We all heard about the misfortunate tale of Equifax, losing all their customer data in one major breach. According to their disclosed information, it was all due to the Apache Struts Remote Command Execution vulnerability found in their servers. In fact, if this was the case, then the whole attack might have started and finished within seconds, using one HTTP transaction sent to their website. I hereby try to explain and give an example to how such attacks occur, and what possible implications they bare.

What is Apache Struts?

According to Wikipedia, Apache Struts is “an open-source web application framework for developing Java EE web applications. It uses and extends the Java Servlet API to encourage developers to adopt a model–view–controller (MVC) architecture.”

As Java Enterprise Edition, and its ecosystem are popular amongst financial institutions, this makes our story even more intriguing. It creates a dangerous mix of those tasked with safekeeping our money, with a new kind of inherent vulnerabilities in their underlying infrastructure.

What is Remote Command Execution?

OWASP categorizes this type of attacks as “Command Injection”, defined as “an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.”

Attack Synopsis

How does the actual attack work?

Attacks in the wild are seen abusing the HTTP “content-type” header to inject the malicious code. The hackers usually first test a simple expression evaluation by bash commands, to validate the injection vector is successful. They subsequently try using commonly found utilities, such as WGET and CURL, to download malicious code onto the vulnerable server.

The holy grail is, of course, complete server takeover. This is usually achievable by installing a web-shell backdoor. This type of code allows the attackers to gain remote administrative control of the server using a simple browser and a web connection, which is already available as these are servers exposed to the Web that are being attacked in the first place.

Pwning 4 Mining

I chose an unusual use case for the Apache Struts RCE attack, that CyKick Telepath caught in the wild. The attack above attempts to download what is seemingly an image file. Once downloaded, it is executed as a bash script and serves as a downloader for further code:

The twist in this story is that the final results launches a stealth crypto-currency mining process using the CryptoNight algorithm. Since the attackers are probably aware that most Linux servers on the Internet do not contain powerful GPU’s, they chose an efficient algorithm that could run on any general-purpose CPU.

Conclusion

As always, keep your systems up-to-date to minimize the exposure time window. Audit your code, keep yourself up to speed with the latest trends in application security. And of course, monitor all your web applications for malicious and suspicious web user behaviour.

Goodbye 2018, Hello Privacy

noreply@blogger.com (Raviv Raz) — Mon, 31 Dec 2018 22:48:00 +0000

As fireworks burst through the night,
I sat to review 2018 from my point of view:

Sold my web behaviour analytics technology to a cyber security vendor
Went back to the frontlines and learned more about cyber market needs
Got hired by corporations to hack wireless, web, cloud, blockchain & corporate systems
Then got hired to design cyber security architectures to counter attacks

It seemed like software vendors were mostly concerned about one major issue: privacy.
Mid 2018 saw the EU GDPR privacy act go into full effect.
It seemed like most of my job was to protect customer privacy before anything else.

On the one hand, corporate businesses collect mountains of information to produce intelligible business intelligence. On the other hand, they are now forced to protect customer privacy at any cost.

In 2018 the AI movement also started making an impact on the cyber market.
For every force there is an equal and opposite force.
And so as cyber security vendors implement machine learning technologies,
Cyber attackers are experimenting with AI to bypass security measures.

2019 opens with nation-state attacks now at full impact.
The powers that be routinely deploy military-grade cyber campaigns against each other.
You will not see it, you will not feel it, but if you're a person of interest,
you've probably been spied on :-)

Welcome to the real world Neo...

Brute Forcing my way back - SSHhh...

noreply@blogger.com (Raviv Raz) — Wed, 24 Jan 2018 01:03:00 +0000

Dear Skiddies,
I've been gone, but not forgotten, me hope.
Meanwhile, some of you got arrested, some of you went legit and turned into CISO's,
while my passion for open-sourcing offensive cyber tools marches on.

The unbearable, inexplicable ease and ubiquitous nature of brute-force attacks in recent years made it iresistable to wanna join the fun and games. Massive IoT attacks made it clear that SSH brute-forcing is a legitimate attack vector, not shaming any skiddy choosing to resort to this means cuz they were too lazy to reverse-engineer firmware for vulnerabilities.

Just to keep it fair this time, I'm releasing tools for both sides of the game at the same time :-)
So if Santa forgot you this past Xmas, here are my gifts to you (freebies - Yey!)

Brute-force your way into LAN servers

You're getting a new toy for 2018: BruteForSSHer.

Imagine you're visiting the offices of Evil-Corp, attending yet another boring meeting.

Run this tool in the background to see if by the time the meeting ends, you can walk away with some free credentials giving you access to internal servers.

Sensing a disturbance in the (Brute) force

If you're on the right side of the law (yawn), you're getting a free audit tool to detect SSH brute-force attacks against your servers. Watch out for those "white-hat" consultants visiting your offices. Who knows what they're running on their laptops, courteously connected to the corporate WiFi, cuz your ass was too lazy setting up a separate network (Ah-oh).

So let the games begin, and have a great year my friends!

2016 and beyond

noreply@blogger.com (Raviv Raz) — Sun, 01 Jan 2017 23:01:00 +0000

Well, it's been a (LONG) while since I blogged last...
Many things have happened since.
I do apologize to all open-source code users, frustrated at my code bugs gone unfixed.
Switching from hacker to entrepreneur, my main attention shifted elsewhere.

But in the meanwhile, RUDY went to Hollywood!
It was nice to see Mr. Robot open the show with a RUDY attack launched against Evil Corp :-)
Since I started blogging here, things that were considered theoretical and apocalyptic by most, became a reality by end of 2016.

For me personally it is nice to finally see the market accept machine-learning and behavior analytics as the future of cyber security. As I predicted this 6 years ago, I founded Hybrid Security to get ahead of the curve, and now it seems like machine-learning and behavior analytics are all people talk about in cyber security.

IoT devices became tools of massive disruption this year, ransomware became the hottest thing and Yahoo! showed us what it means to get hacked BIG time (1,000,000,000 customers compromised...)
But I believe that the real unprecedented story that will be marked down in history was the first cyber attack that swayed U.S presidential elections;

Allegedly sponsored and carried out by Russian intelligence services, this precedence demonstrated how a cleverly picked target, compromised at a perfect timing, can change the course of history.
U.S retaliation is being executed as these lines are written, and so we can expect more interesting developments to come.

So Happy New Year everybody!
It's about to get wild...

Cyber Politics, Shell Shock & Bots

noreply@blogger.com (Raviv Raz) — Thu, 30 Oct 2014 20:01:00 +0000

Bots vs. Politics

Hybrid Security discovered a sophisticated new bot-net made up of compromised Internet servers around the world. Servers were commandeered to serve the activities of cyber criminals. Experienced, professional hackers set out to establish a cyber-attack artillery force using servers with fast Internet connections performed this staged attack. One of the attacks monitored by Hybrid Security, utilised this high-bandwidth network to disrupt the activities of anti-government agencies speaking out against the Putin government. Denial-of-Service attacks were purposed to disrupt access to the news agency website.

Hundreds of organisations around the world were effected by these attacks, and unwillingly conscripted into this global cyber war.

Golosa – Putin opposition news agency that fell under heavy DDoS attacks

Attack & Detection by Hybrid Telepath

Attacker uses Shell-Shock attacks to execute commands on web servers
Hybrid Telepath monitors communications and detects the initial attack
Commands sent by the hacker download bot code into the compromised server
Bot communicates with master via IRC chat channels
Master orders bots to launch a high-bandwidth flood attack against victim websites

Android Trojan Bot Nets

noreply@blogger.com (Raviv Raz) — Fri, 18 Jan 2013 01:06:00 +0000

Security researchers discovered a bot-net of more than 1 million Android users' devices

that have been infected by a variant of Android Trojan malware. Around 7,000 infected apps enabled hackers to send fraudulent SMS messages, siphon sensitive information, download apps and plant adware. Another interesting aspect about these bots is that they are able to hide incoming SMS in order to bypass some authentication systems. The exponential rise in mobile malware is recently challenging E-commerce and financial institutions to examine cross-platform solutions that can be independent of end-client OS and browser. In order to cope with these challenges, Hybrid Security provides the Hybrid Telepath 2.0 behavior analytics solution. As a transparent non-intrusive solution, all mobile and workstation clients are monitored in stealth mode. Since no client software is installed, standard anti-virus bypass techniques are futile against Telepath's surveillance. And although bots of all kinds, shapes and sizes are attempting to mimic user's business logic, they have not gained human intelligence yet.

It will take several years for them to evolve that far.

Thus, human beings' behavior is still fairly different than bots'

By using 3rd generation web security technology, behavior analytics provide a good way to distinguish between bots and humans without the need for predefined signatures or client-side software.

If you're running web applications that support multi-platform end clients, be sure to ask your house security experts about Web fraud prevention solutions that can spot anomalous behavior without signatures.

Signature based AV and IPS are rapidly becoming useless when it comes to defending against bot nets.

2013

noreply@blogger.com (Raviv Raz) — Tue, 01 Jan 2013 01:35:00 +0000

Yes, my friends.
We have survived yet another fake apocalypse, and here comes 2013.
Happy new year cyber warriors. Happy new year hackers to be and cyber criminals.
Merry Xmas Anonymous!
Yes, I am well aware of you guys and girls out there.
I receive your cries for help in your hacking endeavors,
and once in a while thank-you for the tools published on this blog.
I will keep supporting Multinjector and RUDY, as these tools are meant to inspire all you guys out there to seek knowledge, exploration and experimentation. Learn Python, exploit it to its limits and hack your way to better your knowledge. Your support encourages me to go on writing such code, so keep it up and stay in touch.
Having said this, I shall use this opportunity to state once and for all:
NO!
I will NOT help you hack this website or the other.
I shall not join in the future, nor have I ever supported Anonymous or any other cyber crime / political movements. In fact, seeing everything that's going on out there it sometimes seems evil is indeed prevailing, while good is left behind. Talking to senior managers, and reading all the incidents of these past years, makes me sometimes wonder how can people keep being so naive in light of the danger rising on the horizon.
You've heard this all already, so we'll be brief this time, and just in case you haven't,
here come my predictions for 2013 et al;
Storm is coming, and it's no longer made up of occasional sporadic showers. Global super power nation states have picked up on this wonderful thing they now call cyber-warefare. If your country is dependent on its industry's intellectual property, you will be attacked in 2013. If your company has something unique (knowledge-wise) to offer the world, the "bad guys" are coming after you. Doubt not, for the enemy is en-route, if not already hidden within your computing equipment / mobile device / cloud service. Our electricity may one day be sabotaged by cyber attackers. Same goes for our water, food, medicine, transportation and all other modern living support infrastructure. This is imminent and clear danger, according to the Department of Homeland Security. A real "Cyber Pearl Harbor".
You social network and all email accounts will be targeted for reconnaissance and spear-phishing.
Your bank account is under attack as we speak, by threats hidden from the eye, deep inside your browser or operating system. If you are an Android user, your phone is prone to infinite threats against your bank account. If you think being an Apple Mac user is still gaining you immunity against malware, think again and wake up. If you treasure your privacy, it's long gone due to stricter national surveillance policies (and some progressive social network policies as well...)
You are no longer a face in the crowd, nor shall the criminals pass over you the next time.
We are all targets now for global organized crime and nation states.
So WAKE UP!

And keep following current news on our forum at:
http://www.linkedin.com/groups/Web-Fraud-Prevention-4066554

It's the end of the world as we know it (and I feel fine)

noreply@blogger.com (Raviv Raz) — Thu, 20 Dec 2012 21:09:00 +0000

And so my friends, just in case the Mayans were correctly interpreted by the apocalypse foreseers,

I am writing this last blog entry to you. As the great Steve Jobs once signed off:

"Stay young, stay foolish!"

Some say in a few hours the Earth's magnetic field shall be reversed.

Others say Nibiru is on a collision course with Earth as you read these lines.

Cynics claim a nuclear war could be the end of us, but my favorite bullshit theory of all is probably a cyber world war that will send us all back to the stone age. Quoting Albert Einstein, when asked what weapons will be used in WW-III:

"I know not with what weapons World War III will be fought, but World War IV will be fought with sticks and stones."

So get your sticks and stones stocked up, clean up your nuclear shelter, grab a good towel with you in case you are planning on hitching an intergalactic ride right before the end, and cross your fingers.

For those of you who worked in the IT industry back in 1999, this might feel a bit familiar.

Back then, computer illiterates were making similar assumptions regarding Y2K bugs...

Looking back, it was not a bad idea for all computer boffins, squeezing the extra buck out of the mass-panic media hype. Guess someone's making profit once again, I just haven't figured out yet who these people are (history professors?)

But just in case we're all alive and kicking tomorrow morning, I suggest you do beef up your cyber defense, because a global apocalypse may not have occurred,

yet a cyber war is coming, and it's right at your door.

Better be safe than sorry...

Identity Theft & Web Application Attacks Top Verizon's 2013 Cyber Predictions

noreply@blogger.com (Raviv Raz) — Thu, 20 Dec 2012 17:59:00 +0000

According to Verizon's recent "2012 Data Breach Investigations Report": stolen credentials and web application exploitation as the top threats to enterprises in 2013. The unique angle of visibility Verizon enjoys, provides us with real insight into the cyber threats out there. While analysts tend to base cyber incident statistics on public information, Verizon has an astonishing customer base of almost 100 million customers. So when their cyber team comes to such conclusions, I say Hybrid Security's technology is becoming a mainstream requirement for every large organization conducting its business online. Quoting from a DarkReading interview with Wade Baker, principal author of the DBIR:

"Nine out of 10 intrusions involved compromised identities or authentication systems...
...Web application exploits which are most likely to affect larger organizations and especially governments, rather than small to medium-sized businesses. The chances of such attacks occurring are three in four, according to the data compiled by the RISK Team"

With stolen identities used from all sorts of client devices, organizations will need to augment existing authentication mechanisms with Web Fraud Detection solutions that can spot anomalies in user behavior and identity. The kind of solution that Hybrid Telepath provides right now.

Information Warfare 2.0

noreply@blogger.com (Raviv Raz) — Sun, 05 Aug 2012 20:45:00 +0000

The next time they tell you not to believe everything you read on the news, well.. this is what they mean.

Information Warfare has long been used as a military tactic. It does not necessarily involve cyber techniques.

Influencing public opinion and mass brainwashing, have become mission-critical tools at the hands of totalitarian regimes. Nowadays it sometimes seems like winning the public debate is more important than winning the war. In the book "1984", a pseudo-communist regime employs huge departments and human resources in order to constantly change present and past news. Attacking the enemy morale by deception is as old as the Chinese empire, and has also been described in length in Sun Tzu's "The Art of War", as an important resource at the disposal of generals. It is no wonder then, that Bashar Al-Assad's declining empire should choose to hack the Reuters blogging platform, in order to falsify the opposition's signals of defeat. A false withdrawal has been announced during the alleged interview with Riad Al-Asaad, commander of Syrian Free Army. As posted by Reuters, this "was fabricated by the regime, as it seems the news agency was hacked"

This type of warfare has also been the the narrative in the 1997 James Bond movie "Tomorrow Never Dies"

As the plot unfolds in Tomorrow Never Dies, 007 attempts to thwart an evil scheme, planned by a media mogul, to ignite a world war III and profit from the spoils. Manipulating the news has sparked the imagination of Hollywood, and apparently inspired Bashar Al-Assad's Information Warfare units as well. The techniques being used in this incident are less interesting, as these guys are not exactly renown for being highly sophisticated (refer to the Syria Files). What is interesting is the attempted manipulation of a high-profile news agency for political propaganda and IW campaigns. I mean, if we can't trust Reuters, a root supplier of news to other agencies, what about the rest of the media?

I leave this question to you, dear readers, to ponder upon, the next time you pick up a newspaper or zap to your favorite news channel ;-)

The Pervasiveness of Identity Theft

noreply@blogger.com (Raviv Raz) — Wed, 25 Jul 2012 16:18:00 +0000

According to a new report by CIFAS:
"While the 5% increase in overall fraud levels during the first half of 2012 is noteworthy enough, the fact that identity fraud (the use of a false identity or the identity details of another person) now accounts for 50% of all frauds is unprecedented. In addition, 15% of all recorded frauds in the first half of 2012 related to the takeover or hijacking of a customer's account. This means that frauds relating to the misuse of identity details now account for an astonishing 65% of all fraud"
In light of the massive account hacks in LinkedIn and Yahoo, this is no surprise.
It only goes to show that:
A) The corporate world has not yet learned how important it is to protect Web assets
B) Account takeover scams still flow under the radar, as the usage of web user behavior analysis
systems is not sufficiently prevalent
Though mandatory for US financial institutions by the FFIEC regulation, other market sectors are slower to adopt web fraud prevention technologies. If you recall the beginning of the PCI hype, sparked and sponsored by the credit card industry, things were not looking better before in terms of web application security. Only when merchants were compelled to level with PCI standards, including the deployment of Web Application Firewalls, did attacks such as SQL Injection and Cross-Site Scripting begin to decrease. As usual, banks are first in line to deploy disruptive cyber security measures. However, as fraud begins to menace e-commerce, solutions such as Hybrid Telepath, are becoming more popular among online merchants, exposed to great business continuity risks, now more than ever.

Facebook Click Fraud

noreply@blogger.com (Raviv Raz) — Mon, 25 Jun 2012 21:16:00 +0000

Facebook is the name, and click-fraud is the game. Yes, it seems that click-fraud is making a comeback in 2012. Once the plague of Google, Facebook is now facing advertisement revenue loss due to a Web 2.0 worm manipulating end users to load fraudsters' ads instead of Facebook's own revenue-generating ads.

As reported by Symantec in May 2012, the Mac-based Flashback was built to rob Google of ad-click revenues at an estimated rate of $10,000 per day. Then came Facebook's turn when LilyJade emerged:

LilyJade Command & Control module - SecureList.com

Sergey Golovanov from Kaspersky, analyzed and published his findings, regarding a new browser plugin that utilizes innovative cross-platform technology to scam Facebook out of ad revenue. Facebook is not alone in this exclusive club. Yahoo, YouTube, Bing/MSN, AOL and Google are also victims of LilyJade. But Facebook also serves as a major conduit for viral propagation of LilyJade. Once you're infected, this plugin tempts your Facebook friends to also install LilyJade in order to watch a video on your Facebook wall. It is amazing how simply LilyJade achieves this using the existing framework:

LilyJade Facebook propagation code - SecureList.com

LilyJade interacts with the Web via a Chrome plugin, written in Javascript. It has a back-end bot that invades end-user PC's. According to its developer, it offers the following capabilities:

Download
Update
Execute
Sync with server
Auto Update every 6 hours (EVEN IF BOTKILLED)
Viral Spreading (Automatic)

For fraudsters looking to inject their own ads, instead of the legitimate websites' this tool is offered to registered BlackHat Forums users for $1000:

LilyJade promotion on BlackHat Forums

With Twitter support coming up on Crossrider's road-map, it seems that no Web 2.0 application is safe against fraud anymore. Without user behavior analysis systems, deployed for Web Fraud Prevention, I suspect millions, if not tens of millions of dollars are still going to be lost in ad revenue in 2012-2013.

LinkedIn Password Leak Check Source Code Exposed

noreply@blogger.com (Raviv Raz) — Thu, 14 Jun 2012 17:56:00 +0000

Due to popular demand (and mass paranoia), here is the server-side code for 
Hybrid Security's LinkedIn Password Leak Check. You may reuse this code for 
non-commercial applications. In case you do choose to use this code, kindly 
provide alink to http://www.hybridsec.com in the spirit of open-source sharing
The client-side code is obviously open for review and download at your nearest 
browser: http://www.hybridsec.com/linkedin/
Basically, it verifies that the hash is valid (40 alphanumeric chars).
Then it searches for the hash in full, or in partial form with the 
0 padding.Of course you will need the actual hash file to perform 
this search. 
Enjoy ;-)

#!/usr/bin/env python
# (c) 2012 All rights reserved - Hybrid Application Security Ltd.
# http://www.hybridsec.com

print """Content-Type: text/html\n\n"""
from cgi import FieldStorage
from re import match,compile
import cgitb
cgitb.enable()
alphanum = compile("^[0-9a-zA-Z]{40}$")
def valid(value):
   if match(alphanum,value):
      return True
   else:
      return False
def isStolen(pwd):
   padded = "00000"+pwd[5:]
   hashes = open("PasswordDatabase.txt").read()
   if (pwd in hashes) or (padded in hashes):
      return True
   else:
      return False
form = FieldStorage()
if len(form) == 0 or form["passwd"].value == "" or not valid(form["passwd"].value):
   pass 
else:     
   userpass = form["passwd"].value
   if isStolen(userpass):
      print """
Your LinkedIn password has been compromised!
We recommend that you reset your LinkedIn password
"""
   else:
      print "Your LinkedIn password has not been compromised"

LinkedIn Leaked Out

noreply@blogger.com (Raviv Raz) — Sun, 10 Jun 2012 20:05:00 +0000

I guess you've already heard of the LinkedIn passwords leak by now. You haven't?

Well, then, you better check whether your password has been compromised.

Here are two methods to do that:

Check whether your password is among the 6.5 million stolen, online, using Hybrid Security's specially developed system:
http://www.hybridsec.com/linkedin/
Log into LinkedIn and see if they ask you to change password. If they do, you better do as they say ;-)

LinkedIn has so far put the lid on all the juicy details of the hack. We can only assume at this point that one of the common scenarios has occurred:

Someone opened up the wrong email, perhaps containing an APT/Trojan attachment
Hackers have gained remote access via a public resource such as: Website, FTP, SSH, etc

While waiting to hear the forensics results, here are some interesting facts:

Here is a top 10 list of the most common passwords, cracked so far:

link
1234
work
god
job
12345
angel
:the
ilove
sex

Well, it gets you wandering on an philosophical, existential ponder upon life for a moment.

Skipping the obvious 1234.. passwords, one could say people mostly relate to:

"Link work, god, job, angels, love and sex"

With modern advancements in password cracking, namely:

Commodity multi-core CPU's, powerful GPU's and cheap cloud computing power, passwords such as listed above, even in SHA-1 format, are no match for amateur password crackers. So choose your password wisely next time.

But if your LinkedIn account being hacked does not alarm enough, here are a few scary scenarios already in use by criminals around the world:

The hackers now have your password, and (probably) your email and user name
Many people use the same password for Facebook, Twitter and web-mail systems
I have already witnessed two people sending me spam mail right after their LinkedIn accounts have been hacked
If the criminals gain access to your email system, you might as well consider all other accounts, especially on social networks, compromised
Using your email criminals can buy stuff online, at eBay, Amazon, Paypal and many more
Using your email and social networks, criminals can sometimes combine social engineering techniques with personal identification information, to log into your bank account
Your friends might now be receiving Trojan horses, spam and phishing emails on your behalf
Your friends might also be lured into criminal traps via Facebook, Linkedin and so on

So be safe and choose strong passwords (long, capital and small letters, digits and special characters)

Pick a different password for each major web application you use on a daily basis.

And feel free to demand your favorite websites to protect themselves against web fraud and cyber attacks.

Becoming A Millionaire Exploiting Business Logic Flaws

noreply@blogger.com (Raviv Raz) — Sat, 19 May 2012 01:44:00 +0000

Now that all major lucrative websites have web application firewalls, it's getting harder and harder to penetrate their databases. Database firewalls are also becoming fashionable, so there's another obstacle. I've never heard of anyone getting rich off of cross-site scripting, so what do we have left?

Of course, the major underground business remains the great bot-nets stealing credentials and credit card information right from your PC. But for the average non-cartel criminal, it is also a challenging, and time-consuming task to create AV-evasive, persistent Trojans. Then deploying the bait, and waiting, and harvesting machines... ugh... who's got time for all that? Time is money after all. In comes the old fraudster paradigm. You do not have to be a great hacker to notice business logic flaws. All you have to do is follow the white rabbit down the logic work-flow of business applications. Once you've gotten the hang of how most users' experience is, you start exploring what profit could be made, by repetitively performing regular user-allowed processes.

Where small change may be earned by a side-effect of the application's business logic, millions can be made from mass transactions. What the risk management team has missed out on, and the programmers shouldn't really mind about, is the crook's delight. Obviously, when rolling out a web business application, the business people concentrate mostly on how to optimize ways of making money. It is logical problems that fall between the cracks in the application design, that allow money to drip out. And like any leak, leaving it running for too long it becomes a flood. For the skeptics among our dear readers, let's take two recent examples from the real world:

Up to 2.5 million dollars worth of flight tickets were fraudulently purchased by rogue travel agents, using stolen credit cards. These mass orders were obtained using a business logic weakness that allowed the criminals to evade the airlines' fraud radars by checking in orders at the last minute, right before the ordering was closed.
The criminal duo brothers, Andrew and Allen Chiu, found a loophole in Nordstorm's e-commerce system. After being banned from purchasing over there, they somehow managed to be rebated for refused transactions. Thus 20-million-dollar deals never made turned into more than 1.4 million dollars in rebate and commissions paid back to the fraud brothers.

These cases add up to Citibank's business logic flaw that led to the attack on approximately 360,000 of its customers' financial data less than a year ago. Forex, telecom and ticket vendors are also high-value targets for business logic attacks. Since no signature can be predefined for this type of attacks, intrusion prevention systems such as web application firewalls cannot detect them. This is why a third generation wave of cyber security is now on the rise. Heuristic behavior analysis assists in understanding normal user behavior patterns on web applications and modeling what should be expected of end users. Business processes are learned by the fraud detection system, and deviations trigger alerts. This is probably the direction all cyber security will take in the next few years. I thus expect today's criminals to also evolve soon, or make way for the more scientifically educated ones. But one thing is for sure - if your cyber security and fraud prevention strategy depends on signature-based systems only, you're in deep deep trouble...

Web Fraud & Business Logic Security

noreply@blogger.com (Raviv Raz) — Wed, 18 Apr 2012 20:06:00 +0000

Thank you to all those who attended Hybrid Security's first Web Fraud conference.
We had a lot of fun having you there. The interest and attendance proved that all major industries suffer from website misuse and cyber fraud. We had an interesting keynote lecture by Mr. Shahar Geiger Maor, from the STKI market research group. Maor gave a bird's eye view on the current state of cyber warfare. Then, I gave a lecture on Web Fraud & Business Logic Security. It covered various business sectors who suffer from different fraud and misuse problems caused by malicious web users. Finally, we had a lecture by A.D (alias), who showed us how vulnerable and exposed we all are to information gathering, using only public websites for open-source intelligence. Our personal life, religious and political opinions are apparently all exposed to the dedicated researchers. I am hopeful you all had a good time, and for those who could not attend, you may download the above presentations and make up for your absence.
Hope to see you at our next gathering!
Raviv.

IBM Predicts Artificial Intelligence Will Lead Cyber Security

noreply@blogger.com (Raviv Raz) — Thu, 29 Mar 2012 22:21:00 +0000

IBM Watson - New dawn for AI?

Director of IBM Institute of Advanced Security in Europe, Martin Borrett, has stated in an interview that artificial intelligence will be a major force in cyber defense. This statement emphasizes Hybrid Security's vision. Being a pioneer in implementation of machine learning algorithms, we believe it is crucial for the information security industry to step up to innovative, disruptive technology. For 25 years now, we have been using the same basic technique to spot the bad guys. Since antivirus was invented in the 80's, security vendors have manufactured the same signature-based, pattern matching mechanisms. This technology was deployed to protect our emails, web browsers, networks and websites. Standing at the historical peak of a malware epidemic, I believe it is clear to all of us by now that this approach is eventually bound to fail. While the criminals have all long evolved, the infosec industry is perhaps comfortably numb at the face of losing this war. While 80% of all malware may still be caught due to old code being recycled, it's this 20% that you should really worry about. Quoth the Art of War: "...Hence that general is skillful in attack whose opponent does not know what to defend"

The attackers need to know but one vulnerability in order to penetrate the fortress. If we don't have the exact signature for that attack, not only will we be compromised, but there will be no evidence of what hit us either. This is because you cannot log what you cannot see. Advanced technology, stemming from Artificial Intelligence algorithms, can adapt to one's surrounding environment during "peace times" and prepare itself to fend against unknown threats during war. Like any good army, AI should also be able to train itself against known enemy techniques, in order to speed up its reaction time and precision. Hybrid Telepath does just this, and beyond, in order to protect online business customers. Would you even consider depositing your money at a bank that is equipped with a 25 year old alarm system? Yet we do this with our money online every day without even thinking about it. The systems we entrust with securing our money, identity, children, national infrastructure and health, are all looking for the same types of attacks that everybody knows about. Thus is is only natural that our cyber assailants would wear masks, and avoid walking along the guarded fences. Our cyber guards were never taught to look for suspicious looking people. Only for those looking exactly as the mug shots they were shown before. How safe would you feel post 9/11 if you knew this is how they detect terrorists at airports?

It does of course make more sense, building on this analogy, that airport security is taught and adapted to the normal population, alongside some hints on what to look for in order to spot the suspicious characters. Intuition may be cultivated using acquired experience as well as expert guidance. This is the basic idea behind the Hybrid Security theory.

Pickpocketing Google Wallet - Mobile Business Logic Flaws

noreply@blogger.com (Raviv Raz) — Tue, 14 Feb 2012 20:43:00 +0000

It is inevitable that our traditional leather wallets shall someday soon disappear, giving way to e-wallets embedded in our mobile devices. However, with the invention of the electronic wallet, cometh the trade of electronic pick-pocketing, of course. So yes, this time the common thief will be a bit more challenged following the actual theft of your phone. Luckily, here comes Google to his rescue. As demonstrated in the video below, a series of a few simple steps easily resets your PIN number and allows the culprit to set a new PIN. But, and here's the business logic flaw, from hereon the culprit can enjoy a hassle-free shopping experience at your expanse. Why is that? because Google's authentication mechanisms identifies the phone's identity and locks on to that specific device. If you're already a valid customer, your phone can go on serving other people with other PIN numbers. So now cyber fraud meets the old-school art of pick-pocketing. But I guess these are merely beginner's mistakes, bound to be resolved by the time this application reaches its massive usage. After all, it's too late not to trust Google with our private information, isn't it? ;-)

All aboard the crazy train !!!

noreply@blogger.com (Raviv Raz) — Sun, 29 Jan 2012 23:01:00 +0000

When the fine line between science fiction / bad action movies and reality becomes so blurred, it is not possible anymore to understand whether the movies get inspired from reality or vice-versa. That is to say, derailing trains from across the ocean is a real and immediate threat to national security today!

"Going off the rails on a crazy train..." quoth Ozzy Osbourne.

It seems a dry test run was launched on December 1, 2011 against a Northwest rail company.

According to to the TSA, a string of attacks, launched against the rail company's computers, originated from overseas. The SCADA infrastructure, used to control the railway was compromised, leading to disruption of train schedules. The attackers' identity has not yet been revealed by the Department of Homeland Security, still investigating the incident. So now the DHS, TSA, FBI and perhaps even the CIA are all scratching their heads to understand what just happened. God forbid a real cyber-terror attack will be launched next, catching us with our pants down in regards to vulnerabilities in critical national infrastructure security. It is now obvious that foreign nations including China, Russia and Iran have attempted and partially succeeded in infiltrating critical infrastructure facilities including a water facility, the power grid and now railway control systems. While it is a continuing debate on whether these SCADA networks should be linked to the Internet in the first place, strict access control and constant security monitoring are neither in place appropriately. While the DHS and FBI acknowledge this type of behavior as (quote) "anomalous activity", I am not so certain such behavioral anomalies are spotted in real-time. Unless apparent disruption is noticed on time, these events are usually noted retroactively.

This is exactly why Hybrid Security developed the Telepath technology. Many APT infiltration incidents are enabled via infected emails. Nevertheless, believe it or not, SCADA equipment is directly connected to Web interfaces and exposed over the World Wild Web more often than we'd like to know. Hybrid Telepath, deployed at critical Web SCADA points, can spot such behavioral anomalies in real-time, providing early alert and possibly saving many lives before the attacks are even launched. So even if standard security measures missed out on a 0-day exploit or logic abuse, Telepath can still detect and thwart the criminal activity before any human lives are put at risk.

Leak Sensor - Pastebin data leakage detection

noreply@blogger.com (Raviv Raz) — Thu, 26 Jan 2012 22:22:00 +0000

Leak Sensor – sensitive data leakage detector

As we all know, the cyber war is escalating. Hackers use Trojans and website penetrations to gain access to sensitive data. This includes email addresses, social security numbers, passwords and much more. The hacktivism movements such as Anonymous exploit Pastebin as a platform for anonymous data publishing. They use it as a "hall of shame" to embarrass large corporations and governments, while the majority of the innocent public is usually unaware of their personal details being exposed. Being a socially aware company, Hybrid Security has decided to release free software that is able to detect personal identification information leaked onto Pastebin.

How does Leak Sensor work?

Leak Sensor saves the sensitive details, entered by the user, safe and encrypted. This data never leaves the personal computer in outgoing traffic. Once in a few (user-configurable) minutes, Leak Sensor runs a quick check on Pastebin in order to verify whether the sensitive data has been exposed publically. Each detail entered by the user is assigned a label. For example: you enter your email address and name is "Email". Leak Sensor runs in the background (you'll find a small icon at bottom right of the system tray). In case data leakage has been detected, an alert appears above the system tray icon, detailing which piece of data has been compromised.

Is it not dangerous to put all the eggs in one basket?

Hybrid Security has utilized the most advanced measures available today, in order to protect the personal data as following:

Data is saved encrypted using AES-256, and is non-readable by unauthorized people
Data is protected by a password that must be entered upon each execution of Leak Sensor
The password itself is saved as a hash value. Therefore, if compromised, there is no way of deciphering it
When resetting the password, all sensitive data is destroyed automatically – just like in Mission Impossible

Personal details never leave the safety of your personal computer and are accessible only to the secret password owner

Where can I download Leak Sensor?

http://www.hybridsec.com/resource.html

How do I install Leak Sensor?

You simply run the installer file and choose a target directory for the installation. A "Hybrid Security" program directory group is created under the Start Menu, where Leak Sensor may be found.

The rest of the instructions are to be found on the included user manual within the zip file.

Hope this helps you keep you data safer. And as always, remember:

Just cuz you're paranoid, it doesn't mean they're not really after ya ;-)

2011 Conclusions & 2012 Cyber Predictions

noreply@blogger.com (Raviv Raz) — Sat, 31 Dec 2011 01:25:00 +0000

Hacking your way out of prison - Mission Impossible?

Yes my friends, we have come to the conclusion of yet another cyber-incident-packed year.
As we look back on 2011, we see a great change both in the extensive usage of cyber warfare, and in the attention the media grants such attacks. In light of recent evidence regarding Duqu, and its relative Stuxnet, it is now clear that cyber warfare has been around for years now, used for military purposes. Prisons are a new target for, perhaps criminal organizations, inspired by Stuxnet. A recent study has shown maximum-security prisons are prone to breaches using SCADA attacks. This has apparently left such an impression on Hollywood script writers, that it plays a major role in the opening scene of the latest Mission Impossible - Ghost Protocol movie. The Department of Homeland Security has also become very much aware of attacks on critical infrastructure, which raised the attention to the contrast between SCADA's exposure to the Internet, and the state of cyber security within such systems. However, I think that everyone would agree this has been the year of social uprising. Being so, the Anonymous and LulzSec groups have caught much attention in their hacktivism acts against government and commercial organizations. The use of cyber espionage and cyber sabotage by civilian, dispersed groups is definitely on the rise, if not at its historical peak. History will teach next generations about the first revolution enabled by the Internet - that started in 2011. Of course, Egypt and Libya would not have fallen without extreme physical warfare. But I doubt whether the masses could be so organized and well communicated with each other had the Internet not been so accessible and widely-spread. In Libya, the need for modern communication was so profoundly understood by the rebels, that a serious operation was carried out, backed by foreign Arab nations, to regain control over the cellular network of Libya, after having it shut down by the authorities. The Occupy movement has followed right after, inspired by global events, and endorsed eagerly by the Anonymous group. It is important to understand this relation in order to understand the popularity this hacktivism has gained among the people. The media feeding hackers' egos - consequently motivating them to operate bigger and better against government and commercial entities. The US, Iran, Russia and China have all shown their presence on the cyber battleground this year. Iran hacked certificate authority Diginotar for use in surveillance over their own people. Iran also claims to have used electronic warfare, via a GPS spoofing technique, in order to hijack a super-secret stealth drone used by the U.S to gather intelligence. The U.S has publicly admitted to considering a paralyzing cyber attack on Lybia's array of radars, prior to NATO's aerial attacks on Muammar Gaddafi's military forces. The U.S military has deferred this tactic due to many reasons, probably not fully exposed to the public. The Chinese have shown great ingenuity by embedding back-doors within integrated circuits, exported to the western world, and used by, among others, U.S military industries. Imagine American radar, missile and communication systems being surreptitiously controlled by the People's Liberation Army of China. The whole Iran-Russia-China love triangle does not make such visions very comforting. So what does the future hold for us? According to security giant McAfee's predictive report, there are a few trends we can expect in 2012:

Industrial threats will mature and segment
Embedded hardware attacks will widen and deepen
Hacktivism and Anonymous will reboot and evolve
Virtual currency systems will experience broader and more frequent attacks
This will be the “Year for (not “of”) Cyberwar”
DNSSEC will drive new network threat vectors
Traditional spam will go “legit,” while spearphishing will evolve into the targeted messaging attack
Mobile botnets and rootkits will mature and converge
Rogue certificates and rogue certificate authorities will undermine users’ confidence
Advances in operating systems and security will drive next-generation botnets and rootkits

So I guess if you're the paranoid type, this would be a good time to cleanup the old nuclear shelter, store supplies for a year or two, pull all your money of the bank, and disappear off the grid:
Lose your mobile phone, close your Facebook account and stop using any and all electronic devices.
Because after all, just because you're paranoid, it doesn't mean they're not really after you
;-)
So I wish y'all a happy new year, be safe, and as Anonymous likes to end their statements:
Expect us...
Ho ho ho!

Operation Ghost Click - Cyber Fraud Shut Down By FBI

noreply@blogger.com (Raviv Raz) — Sun, 20 Nov 2011 02:57:00 +0000

Operation Ghost Click Illustrated on the FBI website

So once again - who said crime doesn't pay?

In the case before us it paid around 14 million dollars!!

Well, until a bunch of Estonian citizens were busted, compliments of the FBI.

It's really starting to look like a clear-cut as far as national motivation for cyber attacks:

The Russians do it for the money, while the Chinese usually do it for mother country - meaning government espionage. Anyways, back to our Ghost Click tale:

Some dudes set up a fake online advertising agency. They go up to some companies and say "We're gonna bring a shitload of web traffic to your websites. And it's gonna be fairly cheap for you guys. Wanna buy?" So I guess the guys being served with this offer say "Hell yea!" and thus begins the sting.

Next, all these fraudsters need to do is to infect something like 4 million (!!) computers over 100 countries with software called DNSChanger. Then this crimeware they spread, changes the DNS configuration on the victim computers.

So now every-time you wanna surf somewhere, this virus thing directs your queries to the criminals' DNS servers. Surprisingly you pass along the way through some of their redirection pages, to assist in traffic generation. This DNSChanger also prevents some security updates on victim computers, just to make sure it will evade future detection and thus prolong its operation. As I've mentioned at the beginning, this gains the fraudsters around 14 million dollars over 5 years. But this uncontrolled, indiscriminate infection spree reaches unexpected corners of the Internet. Among which, half a million American computers are involved, including major businesses and government agencies such as NASA. Now the Feds are really pissed...

So they seize servers all over the place, and ask the Estonians to extradite the apprehended suspects. And based on recent cases, I'm guessing that if these dudes are handed over to the U.S, they're facing a long-long time in prison. So what's the moral lesson here kids?

If you got 14 million dollars, be happy and content with what you have and don't be greedy. Take time off on some exotic island, cover you tracks, live long and prosper. Otherwise, bad boys-bad boys, a whatcha gonna do when they come for you?

The father of C and UNIX has passed away

noreply@blogger.com (Raviv Raz) — Fri, 14 Oct 2011 01:08:00 +0000

On October 8, 2011, Dennis MacAlistair Ritchie passed away at his home. He was 70 years old, and apparently has been ill for a long time. Being a modest and media-shy person, Ritchie did not receive due credit for his contribution to mankind in his lifetime. While the worldwide media is all occupied in Steve Jobs's death, we must remember that none of his achievements would be possible without Ritchie's preceding inventions. For the younger generation of y'all hackers reading this post, remember his name. Learn about his inventions for they have changed our lives in so many ways I cannot even list them all here. Allow me then to refer you to his Wiki page for more elaborate information: http://en.wikipedia.org/wiki/Dennis_Ritchie

Winner of the National Medal of Technology, and the Turing Award, Mr. Ritchie has invented both the C programming language and co-invented UNIX along with Ken Thompson. Without these two, we would not have any of the many things we're used to seeing around us: personal computers, modern operating systems, smart-phones and tablet computers. Our modern cars, trains and airplanes use the C programming language, satellites and telecommunication equipment. Basically everything we know about computers and computer-embedded devices is based on C. Linux, Android and all Apple OS are derivatives of UNIX. It was a true honor to have a living genius among us, who's had such a disruptive impact on technology as we know it. It was with great sadness that I read about his passing away, for the world would probably not have looked the same had Dennis MacAlistair Ritchie not been part of it. May you rest in peace, we are all grateful for the world you helped invent.

Anonymous Skiddies

noreply@blogger.com (Raviv Raz) — Thu, 22 Sep 2011 22:53:00 +0000

As I released R-U-Dead-Yet for the first time in back in mid-November, I wrote:

"...let the mayhem, anarchy and general fun begin!"

Little did I think some script kiddies (or skiddies for short) would actually take the anarchy part seriously. It was simply my way of saying: have fun, a few laughs and keep it real. I did not say "go knock down some government websites for political gain." In my OWASP lecture on HTTP DoS attacks, I mentioned Anonymous incidents that have taken place earlier. I did mention the asymmetric warfare now boosted by such tools as SlowLoris and R.U.D.Y, and of course I stirred a public discussion around the mitigation of such attacks. However, some people are just too lazy to write their own tools, so they wait for the white-hat hacker community to release open-source code. The aforementioned lamers then rewrite these tools to suit their black-hat purposes and irresponsibly use them for political propaganda. Apparently, such was the case with a bunch of skiddies naming themselves "Anonymous Anarchist Action". They proclaim themselves to be some sort of a communist caucus within Anonymous. Anyway, they were too lame to rewrite the whole R.U.D.Y functionality, so they "borrowed" the core idea and ported it into Ruby. Python to Ruby?? this is definitely blasphemy. I mean, set aside the whole political anarchy and cyber-crime part, why would anyone rape a beautiful language such as Python into an inferior, esoteric language called Ruby? Beats me.

At least this time they did remember to write where this was taken from unlike the uncool, blatant attempt to use R.U.D.Y's code under a different label and run it on Windows. Here's what th3j35t3r had to say about that:

http://th3j35t3r.wordpress.com/2011/02/09/xerxes-for-windows-not-on-my-watch/

Back to our rebel skiddies - in case you want to be in the know of how they do their magic, you can check out what they write about the R.U.D.Y port and the PPT lecture that sparked their inspiration:

https://github.com/NetAnarchisT/eRiot/

If you actually care about their political propaganda, here's their cyber-punk-wanna-be video: