Attack Tools Collection

Here is a list of attacking tools collected recently.

AutoDeAuth - A tool built to automatically deauth local networks.

Aced - A tool to parse and resolve a single targeted Active Directory principal's DACL. will identify interesting inbound access allowed privileges against the targeted account, resolve the SIDS of the inbound permissions, and present that data to the operator. Additionally, the logging features of pyldapsearch have been integrated with Aced to log the targeted principal's LDAP attributes locally which can then be parsed by pyldapsearch's companion tool BOFHound to ingest the collected data into BloodHound.

Aura - A Python Source Code Auditing And Static Analysis On A Large Scale. It is a static analysis framework developed as a response to the ever-increasing threat of malicious packages and vulnerable code published on PyPI.

Coercer - A Python Script To Automatically Coerce A Windows Server To Authenticate On An Arbitrary Machine Through 9 Methods.

GraphCrawler - GraphQL Automated Security Testing Toolkit. It is the most powerful automated testing toolkit for any GraphQL endpoint. (Req: Python3, Docker Python dependencies)

pycvss3 - Python API for the CVSS v3.

Common Attacks on SSL/TLS

The SSL/TLS protocols are frequently attacked. And understanding past attacks can inform your knowledge as a defender and help you secure current systems. 

So here's a summary of the common attacks targeting these SSL/TLS from Megan Kaczanowski

Below are my notes about the attacks on  BEAST/Heartbleed/Poodle.

Browser Exploit Against SSL/TLS (BEAST)/2011

• MitM attack that impacted SSL 3.0 and TLS 1.0
• Depends on block ciphers (CBC mode) used by TLS.
• Vulnerable to chosen plantext attack.
• BEAST - exploit for CVE-2011-3389

Heartbleed/2012/2014

• Vulnerability found in the heartbeat extension of OpenSSL library.
• Cause leakage of data in unencrypted format including sensitive credentials, documents.
• OpenSSL (the vulnerable versions were between 1.0.1 and 1.0.1f)
• Doesn't leave any abnormal traces in logs.

Padding Oracle On Downgraded Legacy Encryption (POODLE)/2014

• Flaw in SSL 3.0.
• This attack does require a separate attack to gain this access and MiTM.
• Essentially the message is hashed before sending and at the receiving end, and the re-compiled hash is compared to ensure message integrity, but the padding is not included.
• Practically it is impossible to brute force SSL with this this attack and allows for recovering each byte after a maximum of 256 attempts per byte. That means an attacker could compromise a session cookie or other sensitive information in a few minutes.
  

 

 Attack and Mitigation

Attack	Vulnerability	Mitigation
BEAST	CVE-2011-3389	Upgrade to TLS 1.1 and above
Heartbleed	CVE-2014-0160	Upgrade OpenSSL (avoid between 1.0.1 and 1.0.1f)
POODLE	CVE-2014-3566	Disable SSL 3.0

Links:

• Common Attacks on SSL/TLS – and How to Protect Your System
• A Comprehensive Study of BEAST, CRIME, TIME, BREACH, LUCKY 13 & RC4 Biases
• Everything you need to know about the Heartbleed Bug 
• What is the POODLE Attack?
• CISA SSL 3.0 Protocol Vulnerability
•  

Cyber Attack on Cisco

The threat actors manage to gain access to corporate network even the VPN is protected with MFA. And 2.75GB of data are stolen from Cisco.

IMO, using push notification MFA can be insecure if it is mis-configured. Same for any 2FA or MFA, a mis-configured security controls is just a false sense of security. 

Here is the initial vector from Cisco Talos.

Initial access to the Cisco VPN was achieved via the successful compromise of a Cisco employee’s personal Google account. The user had enabled password syncing via Google Chrome and had stored their Cisco credentials in their browser, enabling that information to synchronize to their Google account. After obtaining the user’s credentials, the attacker attempted to bypass multifactor authentication (MFA) using a variety of techniques, including voice phishing (aka "vishing") and MFA fatigue, the process of sending a high volume of push requests to the target’s mobile device until the user accepts, either accidentally or simply to attempt to silence the repeated push notifications they are receiving. Vishing is an increasingly common social engineering technique whereby attackers try to trick employees into divulging sensitive information over the phone. In this instance, an employee reported that they received multiple calls over several days in which the callers – who spoke in English with various international accents and dialects – purported to be associated with support organizations trusted by the user.  

Once the attacker had obtained initial access, they enrolled a series of new devices for MFA and authenticated successfully to the Cisco VPN. The attacker then escalated to administrative privileges, allowing them to login to multiple systems, which alerted our Cisco Security Incident Response Team (CSIRT), who subsequently responded to the incident. The actor in question dropped a variety of tools, including remote access tools like LogMeIn and TeamViewer, offensive security tools such as Cobalt Strike, PowerSploit, Mimikatz, and Impacket, and added their own backdoor accounts and persistence mechanisms. 

We all can learn more TTP (tactics, techniques, and procedures) from this Cisco breach at Cisco Talos.

Links:

• https://www.bleepingcomputer.com/news/security/cisco-hacked-by-yanluowang-ransomware-gang-28gb-allegedly-stolen/
• Cisco Talos shares insights related to recent cyber attack on Cisco
  

Kubernetes Attack and Defense: Break Out and Escalate!

My notes:

• Pod vs container.
• Pod has a IP address.
• Nodes run kubelet, container runtime, kube-proxy
• Attack K8s from a compromised node
• break out of a container (5 CVEs)
  
• over-privilege pod - mount /dev, access to node filesystem, use of node's network namespace, load module, root access, hostPID, hostNetwork Pods
  
• phish login access to node
• steal kubelet and kube-proxy auth cred, /var/lib/kubelet, service account token
  
• steal secrets from other pods with env
  
• run programs on the node
• create "mirror pods"
• steal cred to the vault
• pull cred for nod's cloud IAM account, http://169.254.169.254/latest/meta-data/iam/security-credentials/<name>/
  
• access to bucket storage/S3
  
• Defenses:
• Admission control, SeccompDefault, Security Profiles Operator, Steering Workloads to Nodes, Upgrade the Cluster.
• Pod Security Policy, Pod Security Standards.
• Open Policy Agent (OPA) Gatekeeper
• Kyverno
  

Links:

• https://www.youtube.com/watch?v=B1hRgTmhPlU
• Attacking K8s - https://github.com/inguardians/peirates
• https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
  

Global Cyber Conflict

With the increase of Cyber conflict at the global level, we should expect increasing risks of cybersecurity attacks and incidents.

Be prepare to face the types of attacks like:

• Malware infection
• DDoS
• Phishing attacks
• Brute-force attacks
• Defacement
• Ransonware

 

Be prepared for:

• Evaluate asset and application configurations to ensure resilience
•  Double-check visibility into the functioning of business-cirtical assets
• Assess incident response processes in the case of an incident

 

Mitigation and remediation:

1. Continuous monitoring
2. Incident response plan
3. Back up data
4. Reduce opportunities for attackers
5. Stay informed 

 

Kubernetes Security: Attacking and Defending K8s Clusters

Note:

• Initial access with 
• known vuln
• Exposed dashboard or 
• Kube API server 
• Exploitation / Execution 
• API endpoint
• get a shell access
  
• Internal recon 
•  env | grep -i kube
• /var/run/secrets/kubernetes.io/serviceaccount
• container introspection
  
• Post-exploitation / Presistence
• privilege escalation
• pod/container escape via privileged pod
  
• Defending K8s
• curl -k https://192.168.1.1:6443
• CIS Kebernetes Benchmark (120+ security checks)
  
• kube-bench (golang)
  
• Image scan
• Clair, docker scan, smartcheck, snyk, Trivy
  
• Cloud-native runtime protection
• Falco (CNCF)
  
• The Pods
• AllowPrivilegeEscalation = false
• ReadOnlyRootFileSystem = true
• RunAsNonRoot = true 
• Use Seccomp, AppArmor and SELinux
  
• Pod Security Policies (PSP) - applied at cluster level (deprecated)
• PSP replacement
• OPA / Gatekeeper
• Kyverno (yaml)
  
• PodSecurity
  
• RBAC (Role Based Access Control)
• --authorization-mode=Node,RBAC
  
• Secure those exposed etcd (cluster objects)
• Encryption at rest not default
  
• The Network Policy
• Among all the pods
• Pods with kube-system namespace
• The Audit Logs
• not enabled by default
• Update K8s !!
  

 

Links:

• K8s Security: Attacking and Defending K8s Cluster
• http://katanasec.com/
• Awesome Kubernetes (K8s) Security
  

Supply Chain Attack and Opensource Library

This is an instance of supply chain attack that targeting opensource software repositories, where 2 popular NPM packages were found to be compromised with malicious code. 

The 2 libraries, "coa" (parser for command-line options) and "rc" (configuration loader), both of which were tempered to include password stealing malware. Additional analysis of the dropped malware samples show it be a DanaBot variant which is a Windows malware for stealing credentials and passwords.

Last month, there is a similar incident where a compromised NPM libraries (UAParser.js) was found.

Links:

• https://thehackernews.com/2021/10/popular-npm-package-hijacked-to-publish.html
  

Glowworm Attack

Here comes the new class of optical TEMPEST attacks: recovering sound by analyzing optical emanations from a LED power indicator.

There are 2 classes of optical TEMPEST attacks against the confidentiality. 1) recovering content from monitors, 2) recovering keystrokes from keyboards.

By analyzing the response of the power indicator LED of various devices to sound and show that there is an optical correlation between the sound that is played by connected speakers and the intensity of their power indicator LED due to the facts that: 

(1) the power indicator LED of various devices is connected directly to the power line, 

(2) the intensity of a device's power indicator LED is correlative to the power consumption, and 

(3) many devices lack a dedicated means of countering this phenomenon. 

Based on these, here comes the Glowworm attack, an optical TEMPEST attack that can be used by eavesdroppers to recover sound by analyzing optical measurements obtained via an electro-optical sensor directed at the power indicator LED of various devices (e.g., speakers, USB hub splitters, and microcontrollers).

 

 

This is a very interesting attack, and you can read the full article at https://www.nassiben.com/glowworm-attack.

 

 

FragAttacks (fragmentation and aggregation attacks)

FragAttacks is a collection of new security vulnerabilities that affect Wi-Fi devices. This is an adversary that is within range of a victim's Wi-Fi network can abuse these vulnerabilities to steal user information or attack devices. 

Three of the discovered vulnerabilities are design flaws in the Wi-Fi standard and therefore affect most devices. On top of this, several other vulnerabilities were discovered that are caused by widespread programming mistakes in Wi-Fi products. Experiments indicate that every Wi-Fi product is affected by at least one vulnerability and that most products are affected by several vulnerabilities.

The discovered vulnerabilities affect all modern security protocols of Wi-Fi, including the latest WPA3 specification. Even the original security protocol of Wi-Fi, called WEP, is affected. This means that several of the newly discovered design flaws have been part of Wi-Fi since its release in 1997! Fortunately, the design flaws are hard to abuse because doing so will requires user interaction or is only possible when using uncommon network settings. As a result, in practice the biggest concern are the programming mistakes in Wi-Fi products since several of them are trivial to exploit.

Design flaws:

• CVE-2020-24588: aggregation attack (accepting non-SPP A-MSDU frames)
• CVE-2020-24587: mixed key attack (reassembling fragments encrypted under different keys)
• CVE-2020-24586: fragment cache attack (not clearing fragments from memory when (re)connecting to a network)

Implementation vulnerabilities allowing the injection of plaintext frames:

• CVE-2020-26145: Accepting plaintext broadcast fragments as full frames (in an encrypted network)
• CVE-2020-26144: Accepting plaintext A-MSDU frames that start with an RFC1042 header with EtherType EAPOL (in an encrypted network)
• CVE-2020-26140: Accepting plaintext data frames in a protected network
• CVE-2020-26143: Accepting fragmented plaintext data frames in a protected network

Other implementation flaws:

• CVE-2020-26139: Forwarding EAPOL frames even though the sender is not yet authenticated (should only affect APs)
• CVE-2020-26146: Reassembling encrypted fragments with non-consecutive packet numbers
• CVE-2020-26147: Reassembling mixed encrypted/plaintext fragments
• CVE-2020-26142: Processing fragmented frames as full frames
• CVE-2020-26141: Not verifying the TKIP MIC of fragmented frames

Links:

• https://www.fragattacks.com/
• https://arstechnica.com/gadgets/2021/05/farewell-to-firewalls-wi-fi-bugs-open-network-devices-to-remote-hacks/
• https://github.com/vanhoefm/fragattacks
  

Attack and Defend: The Dangers of Modern Distributed Applications

 My notes:

• Modern application: API Gateway
• Certificate transparency for discovery web target
• JWT web token at https://jwt.io/
  
• OAuth/bearer token Vs session cookies
• OAuth Phantom token, Split token
  
• Static File storage, CDN
  
• Evil JQuery Javascript, https://github.com/JohnHoder/Javascript-Keylogger
• script integrity and crossorigin  attributes at https://www.srihash.org/  
• Monolith VS distributed web architecture 
  

Links:

• https://certificate.transparency.dev/ 
• https://sslmate.com/certspotter/
  

ShellShock Attack Vectors

Shellshock attack is popular, and wormable too. However, it requires an attack vector for it to works. Here're some of the common attack vectors for shellshock to work:

• (Apache/etc) httpd - If the CGI script calls Bash, the script could execute arbitrary code as the httpd user. mod_php, mod_perl, and mod_python do not use environment variables and we believe they are not affected.
• (Secure Shell) ssh -  It can be used to execute any command, via ssh, scp, git, rsync, etc.
• dhclient - The Dynamic Host Configuration Protocol Client (dhclient) is used to automatically obtain network configuration information via DHCP. This client uses various environment variables and runs Bash to configure the network interface. Connecting to a malicious DHCP server could allow an attacker to run arbitrary code on the client machine.
• CUPS - It is believed that CUPS is affected by this issue. Various user supplied values are stored in environment variables when cups filters are executed.
• sudo - It could still be possible for the running command to set an environment variable that could cause a Bash child process to execute arbitrary code.
• Firefox - No detail about it as of now.
• Postfix - While the Postfix server does call Bash in a variety of ways, the Postfix server will replace various characters with a ?, and may allow an arbitrary environment variable be set by the server. It is however possible that a filter could set environment variables.

Three Web Attack Vectors Using the Browser

Very interesting article on Three Web Attack Vectors Using the Browser: "

Three web attack vectors seem to be responsible for the majority of computer attacks that involve a web browser:

• The attack can incorporate an element of social engineering to persuade the victim to take an action that compromises security. For instance, the victim can supply data to a phishing site or install a program that will turn out to be malicious.
• The attacker can use the browser as a gateway for attacking web applications via techniques such as cross-site scripting (XSS), Cross-Site Request Forgery (CSRF) and Clickjacking.
• The attacker can exploit a vulnerability in the web browser or in local software that the browser can invoke. Such client-side exploits have targeted browser add-ons such as Flash, Adobe Reader and Java Runtime Environment (JRE).

Most attacks include one or two of the three techniques. For instance, Koobface worm targets the user (social engineering to click links) and the web application (hijacking social networking site sessions). An attack that combines all elements would be particularly effective (do you know of any examples?).





The following series of posts explores these three web browser attack vectors in greater detail, discussing how enterprises can protect themselves against such attacks:

• Mitigating Attacks on the User of the Web Browser
• Mitigating Attacks on Web Applications Through the Browser
• Mitigating Attacks on the Web Browser and Add-Ons

— Lenny Zeltser

HotMail, MSN, LIVE Accounts Hacked

An anonymous user posted more than 10K account details on October 1 at pastebin.com.

The list has been removed since it is confirmed that those accounts are genuine. The list of accounts login are starting from A through to B, suggesting there could be additional lists.

Currently it appears only accounts used to access Microsoft's Windows Live Hotmail have been posted, this includes @hotmail.com, @msn.com and @live.com accounts.

Reference:

• Microsoft Spokesperson 
• 10,000 Hotmail Passwords Leaked online.

Facebook CSRF Attack

This attack has caused personal information leakage. The detail of the attack can be found from:

• Facebook personal info leak
• Facebook CSRF attack - Full Disclosure

Here's the anatomy of the attack.

BIND 9 Dynamic Update DoS

This time, ISC BIND 9 contains a vulnerability that may allow a remote, unauthenticated attacker to create a DoS attack. Both POC Exploit and patch are available now. Here's the summary:

BIND Dynamic Update DoS

CVE: CVE-2009-0696

CERT: VU#725188

Posting date: 2009-07-28

Program Impacted: BIND

Versions affected: BIND 9 (all versions)

Severity: High

Exploitable: remotely

Summary: BIND denial of service (server crash) caused by receipt of a specific remote dynamic update message.

McAfee did a good job on summarizing how the attack works. You can follow it here if you are interested in the detail.

References:

• BIND Dynamic Update DoS
• ISC BIND 9 vulnerable to denial of service via dynamic update request

POC exploit is available at:

• Milw0rm
• SecurityFocus

Update: I found that there is a workaround that can be applied if case patch isn't available from vendor. Try this on your own risk.

iptables -A INPUT -p udp --dport 53 -j DROP -m u32 --u32 '30>>27&0xF=5'

Getting into Trouble for Tracking Hackers

Remember the news on DDoS attack against South Korea and US earlier?

According to news at InfoSec Magazine, VNCERT has received an "official complaint" from KrCERT about its efforts to track down the source of computer virus attacks.

DDoS Attack Master Server is Identified

Recently, there is a DDoS attack against South Korea & US networks. Vietnamese security experts, from Bkis, claimed that the master server of the cyber attacks was located in Britain. A report Korean authorities confirmed as credible.

Based on their investigation, about 166,908 "zombie" computers from 74 countries around the world have been used for the attacks and controlled by 8 Command & Control (C&C) servers. They successfully identify the master server after they hack into 2 of the 8 C&C servers.

With this, it allows them to determine the IP address of the master server, which is running Windows Server 2003, is 195.90.118.xxx and that it is located in the UK.


References:

• DDoS attacks on South Korea and USA originated in the UK
• Korea and US DDoS attacks: The attacking source located in United Kingdom
• 'Source of Cyber Attacks Originated From Britain'

Twitter Attacked by (XSS) Worm

A twitter nowadays does not eat worm? How about a worm is attacking twitter?


Twitter has confirmed the attack and closed a vulnerability on last Saturday (Apr 11, 2009). Over Saturday, a worm which uses a cross site scripting flaw in Twitter profiles has been tricking users of the social networking service and directing them to stalkdaily.com.

The worm consisted of JavaScript code hidden in the "Bio" section of the Twitter profile. A user would be sent to view another users profile which contained the script. The script would wait three seconds and grab the user name and twitter cookie for the user. It then used the Twitter API, with the users credentials to modify that users profile, adding the worm and sending tweets about stalkdaily.com.

Twitter users should check their profile's biography field to see if it has changed and if so, reset it. Twitter has reset the password on a number of affected accounts and those users will need to request a new password to regain access.

Top Ten Web Hacking Techniques of 2008!

Top Ten Web Hacking Techniques of 2008 from Jeremiah Grossman.

1. GIFAR

• (Billy Rios, Nathan McFeters, Rob Carter, and John Heasman)

2. Breaking Google Gears' Cross-Origin Communication Model

• (Yair Amit)

3. Safari Carpet Bomb

• (Nitesh Dhanjani)

4. Clickjacking / Videojacking

• (Jeremiah Grossman and Robert Hansen)

5. A Different Opera

• (Stefano Di Paola)

6. Abusing HTML 5 Structured Client-side Storage

• (Alberto Trivero)

7. Cross-domain leaks of site logins via Authenticated CSS

• (Chris Evans and Michal Zalewski)

8. Tunneling TCP over HTTP over SQL Injection

• (Glenn Wilkinson, Marco Slaviero and Haroon Meer)

9. ActiveX Repurposing

• (Haroon Meer)

10. Flash Parameter Injection

• (Yuval Baror, Ayal Yogev, and Adi Sharabani)

Cracking Acrobat 9 Password

Adobe admits Acrobat 9 passwords can be guessed more quickly.

Is this a True-Positive or True-Negative alert?

Adobe recently replied to the online discussion of Acrobat's vulnerability to brute-force attacks. Adobe claims that the specification for the 256-bit AES encryption in Acrobat 9 provides greater performance than the 128-bit implementation in previous versions. It is this improved performance that allows Acrobat 9 to open protected documents much more quickly.

Adobe has admitted that brute-force attacks and dictionary-based password cracks benefit from the program's extra speed, because "fewer processor cycles are required" to test each password guess than with AES 128-encrypted documents. Adobe does not say how much faster attacks can be carried out, but Elcomsoft, a manufacturer of password-recovery tools, claims that passwords can now be cracked 100 times faster.

To help mitigate dictionary attacks, Adobe advises customers to use long passwords or pass-phrases. Version 9 supports Unicode pass-phrases up to 127 characters in length. For even greater security, Adobe recommends using encryption based on the Public Key Infrastructure (PKI), although this requires the use of Adobe LiveCycle Rights Management.

See also:

• Manufacturer claims that passwords in Acrobat 9 are easier to crack than in version 8