SensePost https://SensePost.com doing the web 2.0 thing... Fri, 18 Mar 2016 11:01:49 +0200 Do you group your passwords? https://SensePost.com/blog/2007/do-you-group-your-passwords/ Thu, 31 May 2007 02:41:38 +0200 https://SensePost.com/blog/2007/do-you-group-your-passwords/ This has probably been pondered, but something occurred to me whilst entering my new home.. The guard house grants access based on your fingerprint. The system works pretty sweetly..

Now.. because i have about a zillion accounts, i kinda group my passwords.. since i know services admins on most irc networks read your password, i use XXX for low level access (this might include try once trial software logins).

Slightly more reliable software logins (vmware page / ms partner page) i will use YYY.. i think most people do this..

Whats interesting is that biometric readers deny us this luxury.. So, while my complex thinks its cute.. they take my reading and store it on their win95 machine (clearly i exagerate) but if Internet Banking ever goes biometric (which it often threatens to do) i’ve just given away my login.. Can you tell someone “no.. i dont want to auth using biometrics, cause its the only finger i got!” i think maybe we should..

/mh

]]> 2007-05-31T02:41:38+02:00 Adventures while moving… (Part II) https://SensePost.com/blog/2007/adventures-while-moving%E2%80%A6-part-ii/ ]]> Thu, 31 May 2007 02:55:31 +0200 https://SensePost.com/blog/2007/adventures-while-moving%E2%80%A6-part-ii/ Ok.. so we have an outside gate type thing that leads to our garden. Since we would probably get to the gate at random points of the day / week we figured a combination lock would make sense. Now i know that combination locks traditionally have a pretty small keyspace, and have a horrible reputation so i asked Deels to make sure she got one with at least 4 digits, and had a good name behind it..

So.. with R140 worth of VIRO lock we made our way home.. i set a combination and started fiddling while driving.. Turns out the exact same principles used for lockpicking work ferpectly here too. Apply some downward pressure on the lock, turn the dials (ive always done it in order) and you would find that either the audible click on the correct digit is louder or the dial simply sticks on the correct digit (or a combination of both).

IMAGE-_00471.jpg

I have it down now so i can open the lock in about as long as it would take to pick it (sub 10 seconds consistantly with “blind testing”*)

Ahh well.. maybe we should just tie a piece of string.. might take longer to cut through!

* blind testing == me closing my eyes while deels sets a new combination :>

]]> 2007-05-31T02:55:31+02:00 Windows filesharing on OSX still vulnerable… https://SensePost.com/blog/2007/windows-filesharing-on-osx-still-vulnerable%E2%80%A6/ Sat, 02 Jun 2007 22:42:35 +0200 https://SensePost.com/blog/2007/windows-filesharing-on-osx-still-vulnerable%E2%80%A6/ Aaron Adams over at SYMANTEC, did a quick check on the version of Samba running on currently up to date OSX machines and found that the Macs were still running 3.0.10. He did a quick mod on the existing Metasploit module and has reliable code execution going..

If you are running OSX, you probably want to make sure your samba isnt exposed while you grab the latest source and build..

/mh

]]> 2007-06-02T22:42:35+02:00 Web Mashups point and click style (open invite for Sammy v2.0) ? https://SensePost.com/blog/2007/web-mashups-point-and-click-style-open-invite-for-sammy-v2.0/ Sun, 03 Jun 2007 18:53:48 +0200 https://SensePost.com/blog/2007/web-mashups-point-and-click-style-open-invite-for-sammy-v2.0/ [Yahoo pipes] looks like an awesome way for even non-programmers to create web mashups trivially. Aside from the fact that its interface is super-cool, it brings an interesting dimension to next gen web attacks. (Google Video on Pipes by Pipes developers).

pdp has already covered pipes in his OWASP talk where he used it to re-write a jikto equiv. in almost-0 lines of code, along with a tinyurl filesystem. pdp also mentions Dapper, which i have not checked out till now, but looks like fun waiting to happen too..
In all the services look leet, and look like a cool way to get “unification” going for browser attacks*. Check them out, the possibilities for evil’ness should start running through your head from click 1.

/mh

* evil thoughts aside, the services offer cool hack possibilities like Al-Jazeera News networks news-2sms-service courtesy of twitter and some quick pipes..

]]> 2007-06-03T18:53:48+02:00 Second Life land grab case moves into U.S federal courts.. https://SensePost.com/blog/2007/second-life-land-grab-case-moves-into-u.s-federal-courts../ Mon, 04 Jun 2007 13:19:38 +0200 https://SensePost.com/blog/2007/second-life-land-grab-case-moves-into-u.s-federal-courts../ Ars Technica is reporting on the law suit filed in 2006 by Martin Bragg who accused Linden labs of wrongfully seizing his virtual land.

-snip-

Linden Lab filed two motions to dismiss the suit, arguing that Bragg came into possession of his land wrongfully, but the Pennsylvania judge denied those motions.

-snip-

A few things about this are super interesting..

  • Linden Labs (creators of Second Life) literally sells online assets for real world money..
  • Martin Bragg (from accounts read) found that by simply adjusting his HTTP GET parameters was able to bid on not yet opened auctions.(1)
  • Bragg apparently invested thousands planning to buy low and sell high

We have just started to consider the attack possibilities and where this is going but again, i suspect fun times are ahead (2)..

/mh

(1) A public facing web-app that deals with real money, that is vulnerable to an 80’s style parameter passing attack? tsk.. tsk.. (someone needs to have their web-apps audited!)

(2) i have not yet checked out Hoglund’s new book [Exploiting Online Games: Cheating Massively distributed Systems] but suspect ill take a look soon..

]]> 2007-06-04T13:19:38+02:00 2016-03-18T11:01:49+02:00