Secured! Think Again About That Printer in the Corner

In many organizations the printers are used too often and in some it is collecting dust, apparently, it’s the best target that can be used as an attacking surface. There are countless companies who don’t bother about updating the firmware of their printers, leaving their documents open to attackers. The inventories like printers and others are not even discussed in annual security audits and are assumed to be useless in security aspects.

As printers are seemingly harmless, that’s the exact reason it poses a serious threat. Sometimes, the best attack vector for an attacker is the one to which no one bothers to think about. However, a recent IDC survey found that 35 percent of all security breaches in offices were traced back to an unsecured printer or multi-function device, costing companies $133,800 each year.

Why Companies Should Consider Printer as a Security Threat?

As printers are the essential inventories to business from small organizations to huge corporate level organizations and are ignored when it comes to vulnerability management and assessment. Enterprise security tools are only to protect computers and network; they often do not block or monitor access from the printers. That makes the printer a trouble-free approach to the attacker.

Chris Vickery, a white hat hacker and Security Researcher at MacKeeper said: “Getting control of a printer within an organization can provide a foothold for further attacks and a position to ‘pivot’ out of into networks”.

There are some serious effects if the printer gets compromised and used by attacker, like attackers can capture every document sent to the printer. It could be serious business intelligence comprise that no organization can tolerate.

Preventing Data Loss from Printers

It’s too easy to suggest one ultimate security tip to prevent such threat that includes the replacement of outdated printers with newer models that have some latest security features. Furthermore, Data encryption should be introduced to all latest printers to prevent data exposure if compromised. Although it has been adopted by Xerox in March 2016, other companies should also consider this feature to introduce with their products.

In the end, as IT administrators are responsible to configure printer and other multipurpose device in an organization, they should be aware of the threats associated with those devices so some serious countermeasures can be taken prior to the transmission of data.

Read more

by Malik korrich ~ mercredi 10 août 2016 0 commentaires

Ransomware as a Service System Goes Live

Many companies, hospitals, universities, banks and other financial institutions are being infected by ransomwares. Many ransomware are launched to the black market in this current year that affected victims to pay millions of ransom. Petya and Mischa, two of the most popular ransomwares of 2016 has already threatened businesses from its successful file encryptions.

The developers of Petya and Mischa ransomware have officially made their malicious software open to public, and started Ransomware as a Service (RAAS). The program has launched on July 25, 2016 that pays the distributor a fair share based on the amount of bitcoins they extort from victims.

The 25% share of each 5 bitcoin is paid; while on total of 125 bitcoin per week can earn you up to 85% share. More the bitcoin can adds more percent of share. The developers of RAAS are eager to work with serious distributors only to make most of it before any counter technique is developed.

Petya requires administrative privileges to run so that it can replace the Master Boot Record and encrypt the Master File Table (MFT), which contains critical information about every file. A single dropper is capable of installing Petya or Mischa onto a victim's computer. While if no administrative privilege is obtained, Mischa will infect the victim.

While researching on Petya ransomware, Lawrence Abrams said that:

“Petya causes Windows to reboot in order to execute the new malicious ransomware loader, which will display a screen pretending to be CHKDSK. During this fake CHKDSK stage, Petya will encrypt the Master File Table on the drive. Once the MFT is corrupted, or encrypted in this case, the computer does not know where files are located, or if they even exist, and thus they are not accessible."

There is a decrypting tool available to defend against Petya ransomware but not for Mischa. That’s somehow making RAAS a good business with lots of distributors and profit.

Tim O'Brien, Director of Threat Research at Cloud Security Automation Company, said that:

“Above all else, end user awareness and training regarding the screening of emails and downloading files is the first line of defense.”

Therefore, when it comes to protecting an organization against ransomware, backing up the devices regularly should be considered until counter application is not developed. The installation of reputable and trusted security solution is recommended so that ransom attack can be prevented including suspicious links and email attachments.

Read more

by Malik korrich ~ vendredi 29 juillet 2016 0 commentaires

RHAinfoSec XSS Challenge - 2

Update: The results are announced here.

Welcome readers,

After a tremendous response with our first XSS challenge, we decided to make your lives a bit harder this summer by launching another XSS challenge. Like always, our challenges always challenging and based upon real world scenarios and the key to solving it mostly rely upon the ability to think outside the box.  

The challenge is based upon a a strong blacklist based protection, beware that the challenge may be very hard for you unless you don't understand the right injection context.   

Challenge Rules/Goals

• The challenge goal is to execute alert(1) inside the browser.
• Your payload must render javascript inside modern browsers. 
• The XSS protection header has been set to 0, which would turn off your client side XSS filter. 

Challenge Link

Special thanks to Mr Prakhar Prasad, for deploying the challenge. Alex Infuhr for beta testing and ideas with the challenge.  

• https://challenges.prakharprasad.com/xss/2

Hints/Tips

• If all you can do is ">, then our humble apologies this challenge is not for you. 
• The WAF can be very hard, if you don't know how to properly reverse engineer filter rules. 
• You could refer to my "XSS Filter evasion Cheat sheet" for ideas on cracking this challenge.
• Automated scanners won't help here as often time they fail at producing context based payloads. 

Submissions

Sumbit your vector to rafayhackingarticles@gmail.com or prakhar@prakharprasad.com, or you could DM on my twitter @rafaybaloch, once you have cracked this challenge.

Read more

by Malik korrich ~ dimanche 8 juin 2014 0 commentaires

Rhainfosec XSS Challenge 1 - Writeup

Update - The challenge is still up on hack.me - https://hack.me/101575/bypass-blacklist-based-waf-challenge.html

On 7th January 2014, we announced an XSS challenge for the whole infosec community, the challenge was based upon blacklist based protection and the task was to bypass the blacklist based protection and to execute the javascript. Based upon unique IP addresses we had 1740 participants and more then 80k unique vectors were recorded into our log file which is a tremendous turn out, the size of the log file was around 4.4 mb, which is pretty huge. Out of 1740 participants only 17 were able to solve it, which is less then 1% (0.97 to be exact).

Challenge Setup

To make your lives a bit harder, we induced certain amount of difficulties. Here is an overview of what we had done:

• We blacklisted alert, prompt, confirm, document.write functions which are most commonly used to execute javascript. 
• We blacklisted open & closed parenthesis, which is what most of the XSS vectors require. 
• We blacklisted most commonly used event handlers such as onclick, onfocus etc
• We blacklisted the closing bracket ">". 
• We blacklisted most of the attributes used to execute javascript such as src, formaction, action etc. 
• We blacklisted "+" sign, which otherwise would had been used to concatenate javascript strings, however we did leave a room for it. (More on it later). 
• The winners for the challenge would be decided on the basis of the shortest vector by length. 

Hints

The two of most important hints we gave was as follows:

• Look at alternative javascript execution possibilities. 
• The solution for the challenge was already given inside my "XSS filter evasion cheat sheet", however you would need tweak the payload. (Obviously, there was not point to the challenge, if the solution was already there).

Partial Bypass - Solution

As it was mentioned in one of the hints that you would need to look at alternative javascript execution possibilities. Almost all attributes were being filtered except the "code" and "data" attribute. The "code" attribute can be used along with the "embed" element and the "data" attribute can be object element to execute the javascript. 

Vector #1 

Several instances of the "Object" element were being filtered, however it wasn't difficult for some one to figure it out. The "data" attribute was being filtered out too, however case-sensitive based escaping was not being done. Therefore the final vector would be: