#vulns

[danjconn]

A cool video from one of our security researchers Carlos Fernandez at @sonatypedotcom Mutating remote access Trojans, or RAT mutants, are being found within our Nexus IQ and Lifecycle products, and Carlos pulls them apart. https://www.helpnetsecurity.com/2023/01/24/malicious-packages-targeting-python-developers-video/ #PyPi #malware #vulns #python #RAT https://www.instagram.com/p/CnzIVTDIwvw/?igshid=NGJjMDIxMWI=

[danjconn]

Loving this collaboration with me and my colleagues Hernán Ortiz and Lex Vorona. It's the first time I've written for @sonatypedotcom DevZone so hope the technical background is at the right level! Think my favourite is the low bass on the audio rendering of Text4Shell! Nice to see Log4Shell giving something positive over the holidays this year! Enjoy! https://blog.sonatype.com/caroling-through-the-season-the-sounds-of-the-4shells​ #vulns #music  #cybersecurity #vulnerabilities​ https://www.instagram.com/p/CmchSO9rlPS/?igshid=NGJjMDIxMWI=

[arkansec]

Log4Shell Resources

For those coming to our January meeting, here are some resources you can use to familiarize yourself with Log4Shell / CVE-2021-44228:

Sample Log4Shell Vulnerable App by christophetd

Log4J2 Security Vulnerabilities page

Log4J2 Release History

JNDI Injection Exploit by welk1n

Initial Log4Shell POC by tangxiaofeng7

LunaSec write-up on Log4Shell

JNDIExploit by feihong-cs

Log4j Vulnerability (Log4Shell) Explained // CVE-2021-44228 youTube video by LiveOverflow

[zamoca]

#Romania's #whiteHat #hacker Alex Coltuneac has had three hours of sleep tonight. And last night. And the night before that.

He’s busy trying to find a vulnerability inYouTube live chat, which he plans to report to the company and hopefully get some money in return. None of the bugs he has discovered in the past few days electrifies him, so he keeps digging.

In the past four years, Coltuneac has gotten bug bounty payments from Google, Facebook, Microsoft, Adobe, Yahoo, eBay, and PayPal for flaws he reported. Such bounty programs are a chance for Eastern European hackers like him to pursue a legitimate career in cybersecurity.

And he’s only 19 years old. In a country better known for cybercrime, the teenager is part of small but growing cohort of hackers who are deciding to play it nice. This is a departure for the hacking community of Romania, known for such hits as the hackers Hackerville and Guccifer, and fraudsters who steal money from American bank accounts, perpetrate eBay frauds, and land themselves on the FBI’s most wanted list.

Coltuneac is a freshman at the Babes-Bolyai University in Cluj-Napoca, where he learns Computer Science taught in English. Raised by a family who emphasized honest values, he started using a computer when his was 6. First, he taught himself how to play games, but as he got older he began to see the computer’s potential as a tool to make money. He spent his early teenage years watching fellow Romanian hackers make astounding sums of money selling exploits on the black market. They were able to rake in thousands of US dollars with just a few clicks, far more than Coltuneac’s parents made in a month.  He was a good kid, from a good family. He didn’t want to join them. But he did want to pay for college.

The allure of that life was powerful.

Which is why he was so grateful to find out about bug bounty programs when he was 15. They pay enough to  keep his conscience clear and his bank account full. Bounties cover the cost his education and living expenses, so “there’s no excuse to break the law,” he said.

Coltuneac won’t say how much he earns as a vulnerability hunter, yet gifted white hat hackers doing the same kind of job brag about making in a lucky month about $6,000. That’s how much an ordinary Romanian earns in a year.

The average take home pay in the country was about $520 a month this March, one of the lowest in the European Union.

On the white market, a flaw found and reported legitimately is priced at a few hundred dollars, enough for Coltuneac to pay his rent this month. Sensitive ones are often rewarded with several thousand dollars. In very few cases, the bounty exceeds $100,000. He’s constantly hoping to find one of those. And that sum is still far less than what he would get if he sold the same vulnerabilities on the gray or black markets. (Gray markets sell exploits to nations and corporations to use against their foe; black markets sell to the highest bidder, often criminals.) Zerodium, a gray hat vulnerability broker working with law enforcement and intelligence agencies, awards a hacker up to $500,000 for a high-risk bug with fully functional exploit.

Patching Giants

Coltuneac started hunting vulnerabilities when he was 15, after visiting a Romanian cybersecurity forum, in his free time after school. Like most Romanian hackers, the teen is self taught. Soon, he got his first few hundred dollars from Google, and used them to buy himself a brand new computer. His desktop was dead slow.

“I got lucky. I found a sensitive file. I used brute force,” he said.

The tech giant is among the companies he closely monitors for bug bounty programs. He has recently found an LFI vulnerability and several XSS flaws in Google FeedBurner. Last year alone, Google awarded over $2 million to security researchers globally, and since 2010, when it began its bug bounty program, it has paid a total of $6 million. For 2015, Google highlighted Romania as among the top countries bug bounties were paid out to.

Coltuneac has also made it to Microsoft’s Bounty Hunters: The Honor Roll. This spring he found an XSS vuln in their OAuth interface. Microsoft is constantly improving itsbounty program, and last year, the company included rewards for flaws found in Azure, ASP.NET, .NET Core runtime and the Edge browser.

“[W]e added Hyper-V escapes to the Mitigation Bypass Bounty list, paying up to $100,000, and in August 2015 we increased the Bounty for Defense from $50,000 to $100,000 in order to bring security defense research up to the same level as vulnerability research,” Chris Betz, Senior Director, Microsoft Security Response Center told WIRED.

The company did not provide WIRED numbers concerning the total amount of money paid on bug bounty programs. However, according to data available online, Microsoft has given white hat hackers on the Honor Roll a total of $650,000 on mitigation bypass submissions, since 2013. Another $110,000 went last year for flaws reported in Edge technical preview.“The average payout for Europe-based researchers is $6,000, including a $100,000 bounty recently awarded to researchers based in Germany,” said Betz.

On Trend

Coltuneac is industrious when it comes to finding a pay day. Along with looking at companies directly, he also uses HackerOne and Bugcrowd, platforms that help organizations set up bug bounty programs. Some of the top researchers working on the two platforms are based in Eastern Europe, according to Kymberlee Price, Bugcrowd’s Senior Director of Researcher Operations. This is ironic in some ways, because they are helping to improve websites that they often can’t afford to use themselves, in many cases–Tesla Motor’s web site, for instance.

Eastern European countries, Romania included, have some of the highest average reputation scores for hackers in Europe, calculated based on submissions to HackerOne, according to co-founder Michiel Prins. “We have well over 200 hackers from Eastern Europe who have earned bounties, some are even in the top 50,” he told WIRED. HackerOne customers have to date fixed over 20,000 security vulnerabilities and paid 2,500 researchers over $6.5 million for their contributions, according to Prins.

With bug bounty programs, companies across all industries have started offering money instead of T-shirts, USB sticks or plain ignorance when a white hat hacker finds a flaw in their products. This is wonderful news for everyone, as WIRED has explained, as it incentivizes better security and helps keep talented hackers from going over to the dark side. But more specifically, for Alex Coltuneac and Eastern European security enthusiasts who formerly had only nefarious hacking opportunities in their native lands, this is great news. More bug bounty opportunities means more cash and more sleepless nights. And no reason to consider criminal hacking.

It’s 7 a.m. in Cluj-Napoca and Coltuneac is sipping his coffee. He’s ready to go to class. “Bug hunting is awesome, but school comes first.”

(via The Romanian Teen Hacker Who Hunts Bugs to Resist the Dark Side | WIRED)

[jhavelikes]

"security vulns moves into beta testing"

Collective noun search for security vulns moves into beta testing • The Register | http://ift.tt/1Ja470o | August 21, 2015 at 08:54PM

[returntopk]

How I'd test vuln_fire limits

In general, if you're resistant to something, you take ~75% damage from that type. And if you're vuln to something, you take ~125% damage. So without testing it, I am pretty certain that one res_fire item will equalise my vuln. But if I wanted to test that, this is how I'd go about it:

Find opponent with flaming weapon/breath attack (player or mob).

Fight it n times with 0 cloak. Record each round's HP drop. Average. Make some rough calculations of expected results for 1 and 2 res items.

Fight it n times with 1 cloak. Record each round's HP drop. Average.

Fight it n times with 2 cloaks. Record each round's HP drop. Average.

Compare averages -- against each other, and against expected results.

Profit.

Pls advise if you see flaws here -- logical or otherwise.

[wolfliving]

IoT vulnerabilities abounding in the home

http://www.darkreading.com/vulnerabilities---threats/how-i-hacked-my-home-iot-style/a/d-id/1306758

How I Hacked My Home, IoT Style

David Jacoby

8/27/2014 05:05 PM EDT

Very often, new terms get overhyped in the IT security industry. Today, as we all look to find out more about the Internet of Things, the typical residence can easily have five devices connected to a home network that aren't computers, tablets, or cellphones. As users in this connected environment, we need to ask ourselves "What's the current threat level?" and "How vulnerable am I?"

Most people know what a computer virus is, that we should have strong passwords, and that it's important to install the latest security patches. But many of us (even those with an IT-security mindset) still focus primarily on protecting our traditional endpoints and forget that there are other devices connected to our networks.

For this reason, I decided to conduct research that would identify how easy it would be to hack my own home. Are the devices connected to my network vulnerable? What could an attacker actually do if these devices were compromised? Is my home hackable? I determined to look for real, practical, and relevant attack vectors to see whether it was.

During my research, I focused on all the "other" devices I have connected to my home network: a smart TV, satellite receiver, DVD/Blu-ray player, network storage devices, and gaming consoles. Before I started, I was pretty sure that my home was pretty secure. I mean, I've been working in the security industry for over 15 years, and I'm quite paranoid when it comes to such things as security patches.

As I started my research, it didn’t take long to figure out just how easy it was to find vulnerabilities in all of the systems. I managed to find 14 vulnerabilities in the network attached storage, one vulnerability in the Smart TV, and several potentially hidden remote control functions in the router.

The most severe vulnerabilities were found in the network-attached storage, several that would allow an attacker to remotely execute system commands with the highest administrative privileges. The tested devices also had weak default passwords; lots of configuration files had the wrong permissions; and they also contained passwords in plain text.

When I investigated the security level of the smart TV I discovered that no encryption was used in communication between the TV and the TV vendor’s servers. I was able to replace an icon of the Smart TV graphic interface with a picture, showing the potential for a man-in-the-middle style of attack. 

The DSL router used to provide wireless Internet access for all other home devices contained several hidden dangerous features that could potentially provide the Internet service provider remote access to any device in my private network. The results were shocking, to say the least….  (((etc etc)))

[ecstaticsec]

Self-defined as "a global web application vulnerability search engine" PunkSpider is sort of like a Shodan for web vulns. But not really. But kind of. I played around with the app a bit last year but, the recent maturity has certainly got my attention again. I caught some of the demos at the end of the SchmooCon 2014 LiveStream and had a some lulz at the VNC pwnage. #PunkSpider hyperiongray​

Oh and just a heads up, unless enough people harass DotSlashPunk on Twitter, the PunkSpider webapp does not scan .gov and .mil TLDs. You'll have to setup your own Hadoop cluster and install PunkScan for that.

Only one question remains: