Major Flaw in MySQL and MariaDB

Major Flaw in MySQL and MariaDB that bypasses the authentication and the guy who discovered it + Extras June 11, 2012 It’s all over the news and tweets now in the #Infosec World! A major security flaw in MySQL and MariaDB has been found by Sergei Golubchik (Date: Sat, 9 Jun 2012 17:30:38 +0200). In the oss-sec mailing list, he said that: All MariaDB and MySQL versions up to 5.1.61, 5.2.11, 5.3.5, 5.5.22 are vulnerable. MariaDB versions from 5.1.62, 5.2.12, 5.3.6, 5.5.23 are not. MySQL versions from 5.1.63, 5.5.24, 5.6.6 are not. This issue got assigned an id CVE-2012-2122. Here’s the issue. When a user connects to MariaDB/MySQL, a token (SHA over a password and a random scramble string) is calculated and compared with the expected value. Because of incorrect casting, it might’ve happened that the token and the expected value were considered equal, even if the memcmp() returned a non-zero value. In this case MySQL/MariaDB would think that the password is correct, even while it is not. Because the protocol uses random strings, the probability of hitting this bug is about 1/256. Which means, if one knows a user name to connect (and “root” almost always exists), she can connect using *any* password by repeating connection attempts. ~300 attempts takes only a fraction of second, so basically account password protection is as good as nonexistent. Any client will do, there’s no need for a special libmysqlclient library. /* More info on seclists.org */ Thus, if an attacker guesses the correct username (example: “root”), he can easily connect to the mysql server by using a random password by repeating connection attempts. This issue got assigned an id CVE-2012-2122. But the good thing here is that it’s only applicable to versions 5.1.61, 5.2.11, 5.3.5, 5.5.22. The versions 5.1.62, 5.2.12, 5.3.6, 5.5.23 fro MariaDB and versions 5.1.63, 5.5.24, 5.6.6 are not vulnerable to his discovery. But who is Sergei Golubchik? Sergei Golubchik Well, for those of you who don’t know Sergei Golubchik then today is your lucky day (If you are reading this)! He is the MariaDB Security Coordinator, primary architect of the MySQL/MariaDB plugin API and the author of the “MySQL 5.1 Plugin Development” book. He has been modifying MySQL source code since 1998 and has continued doing it as a MySQL AB employee since 2000. Cool !!!! The Infosec World is proud of you Sir Sergei Golubchik. A few days later, HD Moore of Metasploit posted a report in their website (Jun 11, 2012 12:51:25 AM) about a one-liner in bash that will provide access to an affected MySQL server as the root user account, without actually knowing the password: $ for i in `seq 1 1000`; do mysql -u root –password=bad -h 127.0.0.1 2>/dev/null; done mysql> He also reported about the Linux distributions that were affected based on the reports of other users and researchers. Then, Jonathan Cran (CTO of Pwnie Express and Metasploit contributor) committed a threaded brute-force module that abuses the authentication bypass flaw to automatically dump the password database. The metasploit module for the said exploit is auxiliary/scanner/mysql/mysql_authbypass_hashdump: mysql_authbypass_hashdump So what are you waiting for? Check your mysql server version and use the module mysql_authbypass_hashdump to rape it. If it is vulnerable then update it! Check the references below to get some more information about this serious bug. :) Also, Joshua Drake provided a sample application which he called CVE-2012-2122 checker to determine if your system is vulnerable or affected. CVE-2012-2122 checker References: http://seclists.org/oss-sec/2012/q2/493 http://en.oreilly.com/mysql2011/public/schedule/speaker/639 http://www.net-security.org/secworld.php?id=13076 https://community.rapid7.com/community/metasploit/blog/2012/06/11/cve-2012-2122-a-tragically-comedic-security-flaw-in-mysql Tags: #Infosec World, auxiliary/scanner/mysql/mysql_authbypass_hashdump, CVE-2012-2122, database pawning, HD Moore, Jonathan Cran, Joshua Drake, MariaDB, memcmp, Metasploit contributor, MySQL, mysql -u root --password, MySQL 5.1 Plugin Development, mysql_authbypass_hashdump, mysql_hashdump module, oss-sec mailing list, Pwnie Express, seclists.org, Sergei Golubchik | Categories: Blog Jay Turla Jay Turla is a Filipino security researcher, programming student, infosec enthusiast, open source advocate, and the blog manager of PenTest Laboratory. He is interested in Linux, OpenVMS, penetration testing and vulnerability assessment. He is one of the core team members of The ProjectX Blog and one of the bloggers and goons of ROOTCON (Philippine Hackers Conference).You can follow his tweets @shipcod3.

Backtrack 5r2-PTE1

Checking out BackTrack Linux 5r2-PenTesting Edition Lab! Posted by Shipcode at 10.6.12 What's a BackTrack Linux 5r2-PenTesting Edition Lab? What's with the edition thingy? Isn't BackTrack 5 a pentesting distro already? Why make a pentesting edition? Maybe these are some of the questions you have in your mind after reading the title and because of that, I would like to give some few points about this edition. BackTrack Linux 5r2-PenTesting Edition Lab is still the same BackTrack 5 r2 with the same pentesting tools pre-installed in the distribution and has KDE as its Desktop Environment although in backtrack-linux.org you can also choose if you want Gnome or KDE. The only difference is that it includes all of the hosts, network infrastructure, tools, and targets necessary to practice penetration testing for the CPLT or Certified PenTest Laboratory course which is brought to you by PenTest Laboratory and the guys behind PenTest Magazine. This edition is a modified version of NETinVM which has a predefined User-mode Linux (UML) based penetration testing targets. When started, this builds an entire network of machines within the VMware virtual machine. The BackTrack Linux distribution is used to provide the tools necessary for completing the lab scenarios. Thus, It is an an all-in-one penetration testing lab environment that pre-configured with: - A master (base) host utilizing BackTrack Linux 5r2 - A DMZ network with two hosts (targets) - An “internal” network with one host (target) - A pre-configured firewall This pentesting lab is available for free to non-CPLT course students which can be downloaded here. Here are some of targets you can attack or play with: - 10.5.0.1 - 10.5.0.254 - 10.5.1.10 - 10.5.1.254 About the Contributor: Shipcode is a prolific blogger of ROOTCON and at the same time an InfoSec enthusiast from Cebu. He was inspired to join ROOTCON as part of the core team to share his knowledge in information security. He encourages other like minded individuals to come forward and share their knowledge through blogging right here at ROOTCON Blog section. ROOTCON is managed by like minded InfoSec professionals across the Philippines. All rights reserved. Designated trademarks, brands and articles are the property of their respective owners. Labels: BackTrack 5, DMZ network, hosts, network infrastructure, PenTest Laboratory, pentesting edition, pre-configured firewall, tools, virtual penetration testing lab 0 comments: Post a Comment Newer Post Older Post Home Subscribe to: Post Comments (Atom) Twitter Updates Subscribe To Posts Comments Contributors Silver Hawk Paola Shipcode Semprix (The Fork Meister) ROOTCON Blog Archive ▼ 2012 (32) ▼ June (3) ROOTCON 6 SpeedTalks Checking out BackTrack Linux 5r2-PenTesting Editio... 8 Hacking and Information Security Magazines You M... ► May (5) ► April (10) ► March (7) ► February (3) ► January (4) ► 2011 (70) Cloud Tags #AntiSec (IN)SECURE 2600 accounts airsnare android 4.0 exploit announcements anonymity Anonymous anonymous surfing antisec AP attacks apache logs april 2012 articles asp auditor authentication bypass BackBox Linux backdoor shell backdoor shells BackTrack BackTrack 5 base64_decode bash scripting BashCrew Blackbuntu blackhat blackhat hacker blogger botnets bots Browser settings bypass firewalls Caesar Cipher carders career cbcp defaced CBCP Website Hacked cdo CEGNULUG change IP address CHmag cipher blocking mode citibank hacked clickjacking Clubhack clubhack magazine code gyan Command Execution command injection command-line conference conscience of a hacker cplt Crack WPA in 10 hours crackers credit card hacking credit_cards Cross cross frame scripting Cross Site Request Forgery cross site scripting cross-site scripting crypto geek cryptography CSRF CVE-2012-0056 Cyber Espionage cyber terrorism d4rkb1t Dalnet Damn Vulnerable Web App database database takeover DDoS Debian decode files DECWindows defaced website defcon developers Digital Command directory traversal DMZ network dumping in sqlmap DVWA dvwa tutorial easter easter egg electronic traffic signs hacked encode files encryption algorithms essays eval exec exploit exploit/multi/handler Extasyy Elite ezines F-Secure FBT feedback fern wifi cracker file fuzzer File Inlcusion Filipino filipino hackers Filsat filter evasion FINGER command fix wps Forensic Analysis forensics forms-caching FOSS free channels free shell account FTA games GCC Gerix gma hacked gma news hacking incident Google Chrome grep h4xor bbq hacked sites h

SANS may be pricing themselves out of the market.

SANS provides IT education at a ridiculously high price. They may just be pricing themselves out of the market. There are more and more very good quality sources at reasonable prices coming online and expect many more to start-up. One I have discovered recently is Mile2. The video training is the best I have ever seen and the instruction is excellent. Prices are very reasonable. www.mile2.com In February 2002, Mile2 was established in response to the critical need for an international team of IT security training experts to mitigate threats against national and corporate security far beyond USA borders in the aftermath of 9/11.

HR is broken

In an essay in this newspaper last fall, Peter Cappelli, a professor of management and human resources at the University of Pennsylvania's Wharton School, challenged the oft-heard complaint from employers that they can't find good workers with the right skills. "The real culprits are the employers themselves," he asserted. "It is part of a long-term trend," he adds in an interview, "and the recession caused employers to be able to be pickier, to get even more specific in the skills they think they can find outside the company and to cut back on training." Not surprisingly, his essay drew a lot of response. What did surprise Mr. Cappelli—as he describes in a book, "Why Good People Can't Get Jobs," to be published in June—was the frequency of complaints about the hiring process itself, particularly the now-ubiquitous use of software to screen applicants. A Philadelphia-area human-resources executive told Mr. Cappelli that he applied anonymously for a job in his own company as an experiment. He didn't make it through the screening process. Therein lies a problem. The job market is more than a professional concern for Mr. Cappelli. His son, now 25 years old, graduated in 2010 with a degree in classics from St. John's College and couldn't find a job. Told that health care was hiring, he enrolled at New Orleans's Delgado Community College and got a certificate in phlebotomy, learning how to draw patients' blood. However, he discovered that work experience was essential to land a job. Also, many potential employers were consolidating two medical-related occupations into one, so a phlebotomy certificate alone wasn't enough. He is still looking. For the entire U.S. economy, a lot rides on correctly diagnosing today's job market. If the chief problem is one of too many workers and not enough jobs, then today's unemployment is treatable and there's a case for more fiscal and monetary policy to stimulate demand, or at least for deferring fiscal austerity. But if the problem is chiefly a mismatch between skills employers need and those the jobless have, then more fiscal and monetary medicine won't do much good. That kind of unemployment is treatable only in the long run—with better education and training. Mr. Cappelli leans toward the first view but argues that there's more to this. "For every story about an employer who can't find qualified applicants, there's a counterbalancing tale about an employer with ridiculous hiring requirements," he says. In many companies, software has replaced recruiters, he writes, so "applicants rarely talk to anyone, even by email, during the hiring process." As in other parts of the economy, software has its benefits. It makes applying for a job easier. One doesn't have to trudge down to the HR office to fill out forms. It has broadened the pool of applicants from which employers can choose. It saves money. But at a time of widespread unemployment, the volume of applications is swamping HR departments, many of which have been downsized to cut costs. That has led employers to further automate hiring—and to become incredibly specific about experience and skills they seek. Screening software weeds out anyone whose application lacks particular key words. With so much talent looking for work, why not get what you really need? Here's why: Managers pile up so many requirements that they make it nearly impossible to find anyone who fits. Neal Grunstra, president of Mindbank Consulting Group, a temporary-staffing company, calls this "looking for a unicorn." Mr. Cappelli's favorite email came from a company that drew 25,000 applicants for a standard engineering position only to have the HR department say not one was qualified. One job seeker said "he had been told he was perfect for a given position—except for the fact that his previous job title didn't match that of the vacancy," a title unique to the prospective employer. As anyone who has applied for a job lately knows, the trick is parroting all the words in the job description but not just copying and pasting the text, which leads the software to discard the application. It's a whole new skill: Clearing the software hurdle is as important as being able to do the job. Much of what is broken in the U.S. job market will take a lot of work and time to fix. The current approach to training needs repair, for instance. But some fixes are easier. Employers could, as Mr. Cappelli puts it, "back off the strict requirement that applicants need to have previously done precisely the tasks needed for the vacant job" and "see if they could do the same with some training or ramp-up time." And employers could insist that vendors redo the software so it isn't so picky and flags for personal consideration—rather than discards—an applicant who doesn't quite fit the specifics but might be able to do the job. Write to David Wessel at capital@wsj.com A version of this article appeared May 31, 2012, on page A2 in the U.S. edition of The Wall Street Journal, with the headline: Software Raises Bar for Hiring.

Moral Hazard of Flame

Moral Hazard of Flame & Stuxnet It is becoming increasing apparent that the U.S. Government is behind both Flame and Stuxnet. The poor quality of the latter notwithstanding, the complexity and sophistication of the attacks are not in doubt. Deployment and infiltration techniques require human involvement and impressive technical resources (paid for with tax dollars). Consider the scenario that an 18-year old in a coffee shop or a "cyber-business man" creates a virus, worm or other form of enhanced malware. He then distributes it hundreds or thousands of computers for the purposes of causing damage to someone with whom he does not agree or perhaps to make money. Just as one will text message something that they would never say in person, the attackers feel there is something acceptable about carrying out a form of violence through electronic means. These individuals would be called cyber criminals in most countries. They would be subject to arrest and prosecution using the evidence obtained. As security professionals we are angered, frustrated and concerned about the potential for this to happen to our own organization we are paid to protect. When a government does the same thing to another government, there is a sense that this is acceptable. If the government does this to another government, it is okay, The government is on our side. Stuxnet targeted Iranian fuel enrichment. It caused physical destruction of the infrastructure. Somehow many people seem to feel it is justified and event commendable. But the bigger picture is not discussed. This behavior creates a strategic cyber security threat to all of us. Once this Pandora's box is open, the U.S. is a target for retaliatory attacks. We may say that it is a bad thing but that is only because it is happening to us. Private infrastructure must be a legitimate target because it serves the needs of our government. Furthermore, these attacks may reasonably be considered an act of war. A weapon such as Stuxnet or Flame was used to cause physical and technological damage and steal confidential information. If this is an act of war, retaliation may amount to a missile strike against a U.S. target. After all, not everyone will send a text message when they can speak to you in person. More relevant to security professionals around the world, your private infrastructure may be the target of a cyber or even physical attack. Whatever the reason for the attack, it is our responsibility to discourage this behavior. But we cannot discourage this if we condone or fail to reject this behavior from our own government. In a sense, the U.S. Government may become the single biggest threat to the cyber security of private enterprise. Posted by Park Foreman, CISSP, ISSAP, CEH, CHFI, GIAC 27000 at 7:52 PM 0 comments:

FLAME?

What is all the talk about "Flame"? "Flame". I cannot understand this. There is so much need for people in the IT security community to just understand some basic concepts of IT security. Just like all sports, baseball, football sometimes needs to revisit "back to basics" I think this is what IT security needs to do. Why cannot people contribute "back to basics" IT security learning rather than take time doing articles on an "outlier" rare thing like "Flame". Why the interest in "Flame"? Are IT security managers so egotistical or paranoid that they think that "Flame" is meant for them and their organization?. "Flame" is a very specific targeted malware aimed at Iran much like Stuxnet. It is much ado about nothing. IT is time to get back to thinking about the "basics" of the boring day to day "security in-depth" measures that we get paid to do. 99.9% of IT security people are not going to understand what Flame is about and 99.9% of businesses will not have any negative effects from Flame. So everyone get back to work, working on what you can control.

Intrusion Deception: The 'Tar Trap' Approach to Web Application Security

eSecurityPlanet > Network Security > Intrusion Deception: The 'Tar Trap' Approach to Web Application Security Introducing Microsoft Office 365: Start Collaborating in the cloud for $10 per user per month. Begin your free trial Sponsored Intrusion Deception: The 'Tar Trap' Approach to Web Application Security Juniper's Mykonos Software goes on the offense with a novel approach against brute force authentication and directory traversal attacks. By Sean Michael Kerner | June 01, 2012 Share The deception of one's enemies is a time-tested strategy that dates back to Sun Tzu's The Art of War. Applied to the context of web application security, "intrusion deception" software tricks hackers into thinking they are about to hit the jackpot -- when in fact they've simply been lured into a tar trap whose real purpose is to detect and disable their attack. Mykonos Software's Web Intrusion Prevention System works by inserting bogus server files, forms, and URLs into web applications. Deployed in front of any website or web application, the software inserts the tar traps at serve time and never actually touches the application server. Normal users never see the traps, which can only be found by malicious hackers. The company claims that its technology can detect hackers with absolute certainty and zero false positives during the reconnaissance phase of the attack. In a new release of Mykonos, the software is now going a step further with a series of new protections that make it even more difficult and time-consuming for attackers to go after two common attack vectors: directory traversal and brute-force authentication. The new release is the first since Mykonos was acquired by Juniper in February 2012 for $80 million in cash. Directory Traversal? Check Out These Bogus Files In a directory traversal attack, hackers run automated tools against a site -- trying to spider it and get a map of all the hidden files and directories that are present. The risk with this type of attack is that files that are normally not exposed can be discovered and mined for sensitive information such as passwords and configuration settings. Kyle Adams, Chief Architect of Mykonos told eSecurity Planet that the risk of directory traversal is not something that a Google search would typically uncover. Adams explained that in a directory traversal attack, attackers have a list of common files names that are searched for with a custom tool. These are files that are not linked anywhere else in the site and could include items that are not intended for public disclosure. "What we're doing is identifying people that are probing for random files that don't exist," Adams said. "Once we identify the attacker, then the Mykonos system responds back that the files do exist." Since the tool is recursive, it would send the attacker on a feedback loop that could last forever. So if the attacker is looking for an admin file they will find a bogus file created by Mykonos that goes nowhere. "Google will only spider resources that are referenced from the site," Adams said. "Google will not say there is a readme file if it's not referenced anywhere, whereas that hacker tool will pick that file up." Legitimate searchers are not likely to be requesting a large number of files that don't exist, which limits the risk of blocking real users. The Mykonos system identifies the malicious directory traversal attempt based on the number of attempts. Brute Force? Your Inputs Have Been Changed The other improvement to the Mykonos system is with new brute-force authentication protection. In a brute-force attack, the attacker tries to gain unauthorized use to a system or application by trying out myriad passwords until one works. The traditional way that security systems have dealt with brute-force attacks is by blocking IP addresses based on the number of bad password entries. The Mykonos approach is a bit more devious and is designed to confuse the attacker and waste their time and resources. The Mykonos system looks for failed logins to specific accounts. For example, if someone tries to login as Joe Smith five times and provides the wrong password, the system will serve up a CAPTCHA. The CAPTCHA is the first step and then if the attacker figures out how to get around the CAPTCHA, Mykonos has a layer of defensive deception. "At a certain point, when we see that a particular user has failed to login a certain number of times, we say that from that point forward, for anyone that tries to login to that particular user, we'll mess up the password," Adams said. So if the attacker attempts to login to the Joe Smith account with the password Joe123, the Mykonos system will actually change the input to be something else. As a result, when the attacker submits a password, it will come back as invalid, even if they submitted the correct password. "So someone that is doing a brute force attack, they will have to test every possible combination of passwords and even if they guess it correctly the response will come back as invalid," Adams said. "That's pretty effective against brute force attacks." WAF Signatures While the Myknos system is not technically defined as a Web Application Firewall (WAF), the new release now supports WAF signatures as well. Adams noted that Mykonos now support the open source mod_security WAF ruleset. With the mod_security rules, Mykonos will also be able to block known web application threats. Moving forward, the Mykonos software is still in the process of being integrated into Juniper's larger overall portfolio of solutions. Adams noted that they are still figuring out the different API and integration points. Sean Michael Kerner is a senior editor at eSecurity Planet and InternetNews.com, the news service of the IT Business Edge Network. Follow him on Twitter: @TechJournalist. Ease into NoSQL, making Big Data work. Learn more