Archive for the 'News' Category

Metasploit Site Hijacked by ARP Poisoning Attack

Published at June 7, 2008 in News. 0 Comments

Crackers briefly hijacked hacking tools website Metasploit.com on Monday.

Metasploit is an advanced open-source exploit development platform used by most pen-testers. A tool we often mention here on Darknet.

On Monday the site was redirected to a page announcing the site was “hacked by sunwear ! just for fun“, as recorded by Sunbelt Software.

Unidentified miscreants used an ARP poisoning attack aimed at the network of Metasploit’s hosting provider in order to pull off the hack. The Metasploit project was quickly restored. H D Moore, the creator of the project, explained what happened in response to online reports of the hack.

“Another customer on the same ISP was compromised and used to ARP poison all servers in that subnet. I corrected the problem by setting a static ARP entry and notifying the ISP. To make it very clear - the metasploit.com servers were not compromised, nor have been to this date,” he said

So don’t worry, the Metasploit packages are safe as the server was NOT compromised it was a network level attack and a redirect rather than an actual intrusion.

Source: The Register

Technorati Tags: , , , , , , ,

Apple iPhone Unlocked Again - 1.1.2 and 1.1.3 Firmware

Published at February 18, 2008 in News. 0 Comments

Once again Apple iPhone has been unlocked by a determined youngster, the same who was amongst the first to unlock it last year winning himself a rather nice car and a few 8gb iPhones.

It just shows nothing is infallible, all he needed to find was a writable memory address and he was pretty much done (he used a much higher range of registers than previously).

A teen hacker known for his deftness with iPhones has figured out how to unlock models running the latest firmware versions by cracking a protection that has frustrated hackers for weeks.

The breakthrough by George Hotz, aka Geohot, means people who have bought a recent iPhone will once again be able to use it on the phone network of their choice. Apple makes as much as $400 for every handset that’s activated on an approved network, so its developers have worked hard to prevent the so-called unlocking of iPhones.

A very smart young man indeed, just showing 1 person can indeed defeat the security of a huge multi-national billion dollar company.

And he’s done it twice.

The latest salvo was fired late last week, following a 24-hour hacking spree by Geohot that was broken up by only three hours of sleep. It turns out the latest firmware contained modifications to the device’s memory registers to prevent unlocking. Geohot worked around those changes by finding another, much higher register that was vulnerable.

“I guess Apple thought big numbers were harder to guess,” he wrote.

He then found a way to install his custom-built code by exploiting a flaw that allowed him to erase a range of memory addresses where security software is stored.

An amazing 27% of iPhones are running on unauthorized networks which means they are cracked. Of course Apple will soon come out with a new firmware update that negates this problem….but then the game will just start all over again.

And no one doubt Geohot or someone like him will break it again.

If you want to know how to do it check out step-by-step instructions here from iClarified here.

Source: The Register

Technorati Tags: , , , , , , ,

Multilingual Worm Spreads Over MSN Messenger

Published at January 31, 2008 in News and Articles. 0 Comments

Another MSN worm spreading with the same tactics as usual, “Wanna see my pictures before i send em to facebook?” and so on.

The only really interesting thing about this worm is it sends the message in the language of the locale installed on the infected machine, this is pretty intelligent and is much more likely to work as most of the people on sometimes contact list are probably from the same country or at least use the same language.

The IRCBOT-RB Trojan poses as messages containing links to pictures on social networking sites such as MySpace and Facebook. Typical come-ons involve messages such as “Wanna see my pictures before i send em to facebook?”. Clicking on a link takes users to booby-trapped websites.

Unusually, the polyglot malware changes these messages according to the language of the affected operating system used. Compromised machines are infected by a simple bot agent that leaves the hardware hooked up to a central control server, awaiting instructions.

This would mean it’s much more believable than someone who speaks Portuguese to their friends sending a message in English. As usual please educate people not to blindly follow or click links and definitely don’t accept files sent by friends on MSN/Yahoo! or AIM as they are most likely auto-generated by a trojan.

Do message the person back manually and ask them if they really sent it.

Source: The Register

Technorati Tags: , , , , , , , , , ,

Perl.com Sends Visitors to Porn Site!

Published at January 21, 2008 in News and Articles. 0 Comments

Another tale to do with advertising, it just goes to show it’s really not a good idea to run JavaScript from a 3rd party source on your site, especially if you don’t want your visitors redirected to a porn site!

This is just what happened to Perl.com a few days ago.

Visitors to Perl.com, the O’Reilly Media-owned resource, were redirected on 17th of January to a link farm pushing porn sites.

Geeks who hit the site were sent to grepblogs-dot-net, a site that offers links to live adult webcams, erotic blogs and adult erotic fiction, among other things. Closing the Internet Explorer browser window that contains the site caused another link farm of dubious links to open, from a site called cnomy-dot-com. It carries more porno links and banner ads claiming visitors have won a free iPod.

“I was aghast,” said Tom Christiansen, author of many of the most popular Perl reference books. “I need to understand the nature of the problem.”

Odd that the name of the porn site is pretty geeky too, grep blog? Doesn’t sound like your run of the mile adult webcam directory right?

I guess spammers and getting more clued in, targeting a Perl site..using a geeky blog name - pretty smart.

The episode is the latest example of the perils that come from running ads and javascript from a third-party website. In recent months, rogue ads hosted on DoubleClick, Real Media and others have infected websites. While such services often make life easier for administrators, they also create opportunities for miscreants to defraud users.

Since 2006, HTML code on the Perl.com website has pulled javascript off of the grepblogs site, said Dale Dougherty, general manager of the O’Reilly divisions that’s responsible for upkeep of Perl.com. Once the content on the grepblogs site changed, visitors to the site were soon redirected to other sites. O’Reilly admins fixed the problem at about 6:30 a.m. California time on Friday by nullifying the script.

As many of the members here have done, blocking JavaScript may be a good idea, blocking ads may help or just not surfing at all!

Of course not using Internet Explorer also goes a long way.

Source: The Register

Technorati Tags: , , , , , , , , , ,

GFI Survey - 4 in 10 US Companies are NOT Secure!

Published at January 9, 2008 in News and Applications. 0 Comments

GFI has recently conducted a survey concering corporate security in the US for small and medium sized enterprizes (SMEs).

Despite the best efforts of many small and medium sized companies, a recent US survey shows that four in 10 companies believe that their networks are not secure. Thirty-two percent of the companies also reported that they had suffered a breach in the past 12 months alone citing virus attacks and Internet downloads as the leading cause of the security breach.

The survey, conducted by eMediaUSA on behalf of GFI Software, an international network security software developer, was given to 455 IT executives from U.S. based small and medium sized businesses (SMBs).

Commenting on the results, Andre Muscat, GFI’s Director of Engineering, said: “Email viruses top the ‘greatest threat to network security’ list and this does not come as a surprise. It is one of the easier attack routes and this is confirmed by those respondents who reported a breach. While companies are aware of, and are focused on, tackling viruses and malware, they appear to be giving sparse attention to other equally dangerous threats such as data theft and leakage from endpoints such as connected USB sticks, iPods and PDAs on the network.”

Further results on the survey can be found in the full survey here:

smbsurvey.pdf

Source: GFI

Technorati Tags: , , , , ,