Ira Winkler Presentation

Today, 22 May I listened to an ISSA webex with Ira Winkler as one of the presenters.  The presentation was  concerning the human element involved in organization's security woes. Mr. Winkler's main point was for IT security personnel not to "assume" that the normal company computer user thinks like IT security personnel.  He often hears comments like "our employees know not to do such and such or they would never do anything that stupid".  Mr. Winkler knows from experience that that assumption may not be correct and says that kind of comment "assumes"a certain knowledge base that the normal user may not have.   Mr. Winkler said that while prevention is important, that "detection" is most important.  He went on to explain that IT security should teach the normal user how to "detect" negative events and what to do if they detect such an event.  He said that would include the normal user first detecting the negative event (such as correctly identifying a phishing scam), taking action to stop the negative event (such as not clicking on a malicious link to a phishing scam) and then reporting that to IT security.   He also stated that it was wrong for anyone to assume that they would not be a target of an attack just because they are not a "big fish".  Mr. Winkler warns IT security personnel against making false assumptions of other groups of persons based on their own knowledge base.  He points out that other groups do not have same level of knowledge nor is their perception of IT security problems the same.  Mr. Winkler advocates above all the use of common sense.  Mr. Winkler also advocated using a one-time password for access security and advocates using technology as much as possible to assist common sense in helping to secure organizations systems.

Device serial number of tokens can be calculated by a remote attacker :

A closer look into the RSA SecureID software token

Tags: analysis, public, research, reversing — behrang @ 12:00

Widespread use of smart phones by employees to perform work related activities has introduced the idea of using these devices as an authentication token. As an example of such attempts, RSA SecureID software tokens are available for iPhone, Nokia and the Windows platforms. Obviously, mobile phones would not be able to provide the level of tamper-resistance that hardware tokens would, but I was interested to know how easy/hard it could be for a potential attacker to clone RSA SecureID software tokens. I used the Windows version of the RSA SecurID Software Token for Microsoft Windows version 4.10 for my analysis and discovered the following issues:
Device serial number of tokens can be calculated by a remote attacker :
Every instance of the installed SecurID software token application contains a hard drive plug-in (implemented in tokenstoreplugin.dll) that has a unique device serial number. This serial number can be used for "Device Binding" and the RSA documentation defines it as follows:

“Before the software token is issued by RSA Authentication Manager, an additional extension attribute (<DeviceSerialNumber/>) can be added to the software token record to bind the software token to a specific devicedevice serial number is used to bind a token to a specific device. If the same user installs the application on a different computer, the user cannot import software tokens into the application because the hard drive plug-in on the second computer has a different device serial number from the one to which the user's tokens are bound”.

Reverse engineering the Hard-Disk plugin (tokenstoreplugin.dll) indicated that the device serial number is dependent on the system's host name and current user's windows security identifier (SID). An attacker, with access to these values, can easily calculate the target token's device serial number and bypass the above mentioned protection. Account SIDs can be enumerated in most of the Microsoft active directory based networks using publicly available tools, if the “enumeration of SAM accounts and shares” security setting was not set to disabled. Host names can be easily resolved using internal DNS or Microsoft RPC. The following figures show the device serial number generation code:

The SecureID device serial number calculation can be represented with the following formula: device_serial_number=Left(SHA1(host_name+user_SID+“RSA Copyright 2008”),10)
Token's copy protection:
The software token information, including the secret seed value, is stored in a SQLite version 3 database file named RSASecurIDStorage under the “%USERPROFILE%\Local Settings\Application Data\RSA\RSA SecurID Software Token Library” directory. This file can be viewed by any SQLite database browser, but sensitive information such as the checksum and seed values are encrypted. RSA documentation states that this database file is both encrypted and copy protected: “RSA SecurID Software Token for Windows uses the following data protection mechanisms to tie the token database to a specific computer:
• Binding the database to the computer's primary hard disk drive
• Implementing the Windows Data Protection API (DPAPI)
These mechanisms ensure that an intruder cannot move the token database to another computer and access the tokens. Even if you disable copy protection, the database is still protected by DPAPI.”
The RSASecurIDStorage database file has two tables: PROPERTIES and TOKENS. The DatabaseKey and CryptoChecksum rows found in the PROPERTIES tables were found to be used for copy protection purpose as shown in the figure below:

Reverse engineering of the copy protection mechanism indicated that:

• The CryptoChecksum value is encrypted using the machine's master key, which can only be decrypted on the same computer system, unless the attacker can find a way to import the machine key and other supporting data to their machine
• The DatabaseKey is encrypted using the current logged-on user's master key and provides token binding to that user account

Previous research on the Microsoft Windows DPAPI internals has made offline decryption of the DPAPI protected data possible. This means that if the attacker was able to copy the RSA token database file along with the encryption master keys to their system (for instance by infecting a victim's machine with a rootkit), then it would be possible to decrypt the token database file on their machine. The detailed attack steps to clone a SecurID software token by copying the token database file from a victim's system are as follows:

1. Copy the token database file, RSASecurIDStorage, from the user profile directory
2. Copy the user's master key from %PROFILEDIR%\Application Data\Microsoft\Protect\%SID%; the current master key's GUID can be read from Preferred file as shown in the figure below:

3. Copy the machine's master key from the %WINDIR%\system32\Microsoft\Protect\ directory. Microsoft Windows protects machine keys against tampering by using SHA1 hash values, which are stored and handled by the Local Security Authority Subsystem Service (LSASS) process in Microsoft Windows operating systems. The attacker should also dump these hash values from LSA using publicly available tools like lsadump.


4. Having all the required master keys and token database file, install and deploy a windows machine and change the machine and user SIDs to the victim's system SID by using available tools such as newSID.
5. Overwrite the token database file, user and machine master keys with the ones copied from victim's system. You would also need to find a way to update the DPAPI_SYSTEM value in LSA secrets of the Windows machine. Currently, this is the only challenge that I was not able to solve , but it should be possible to write a tool similar to lsadump which updates LSA secrets.
6. When the above has been performed, you should have successfully cloned the victim's software token and if they run the SecurID software token program on your computer, it will generate the exact same random numbers that are displayed on the victim's token.

In order to demonstrate the possibility of the above mentioned attack, I installed and activated token A and token B on two separate windows XP virtual machines and attempted to clone token B on the virtual machine that was running token A. Taking the above steps, token B was successfully cloned on the machine running token A as shown in the following figures:

In order to counter the aforementioned issues, I would recommend the use of "trusted platform module" (TPM) bindings, which associates the software token with the TPM chip on the system (TPM chip for mobiles? there are vendors working on it).

7 comments

Utah Chief IT officer resigns

SALT LAKE CITY (AP) — Utah's chief technology officer has resigned following the theft of hundreds of thousands of online medical records from state computers by unknown hackers.

Gov. Gary Herbert on Tuesday announced a "comprehensive" response to the massive data breach, including the resignation of Stephen Fletcher, director of the state's Department of Technology Services.

Herbert's office said the state also is hiring a public relations firm to handle crisis communications.

Last month, hackers stole personal information of about 780,000 Medicaid recipients and participants in the Children's Health Insurance Program, including the Social Security numbers of about 280,000 of them.

The state has offered victims free credit monitoring.
Herbert called the compromise of even one person's private data a "completely unacceptable breach of trust" and offered an apology.
"The people of Utah rightly believe that their government will protect them, their families and their personal data," he said. "As a state government, we failed to honor that commitment. For that, as your governor and as a Utahn, I am deeply sorry."

Herbert's apology didn't stop Utah Democratic Chairman Jim Dabakis from going on the attack.

"With an administration marked by one mismanagement scandal after another, we understand why Gov. Herbert wants crisis communications professionals on the scene, but we think most Utahns believe he should pay for it out of his campaign money, not hard-earned taxpayers' dollars," Dabakis said.
To restore public trust, the state has opened bidding to public relations firms until May 21 for a "crisis communication plan and outreach to data breach victims."
On March 30, hackers broke into a Medicaid eligibility server. Officials say security tools on the computer server were installed improperly. Medical clinics used the server to validate claims of retirees on Medicaid and others. The stolen information included birth dates, addresses, and in some cases, Social Security numbers.
Some of the data was said to be indecipherable, or disconnected from a name, making it hard to assess the full damage. State officials have said the information should have been deleted from the server once a claim was validated, and should not have been retained as records.
Investigators have traced the hackers' IP address to eastern Europe, but haven't identified any suspects.
At a news conference Tuesday, Herbert said Fletcher was asked to resign and stepped down. He was appointed to the cabinet-level post in 2005 by former Gov. Jon Huntsman.

Herbert named Mark VanOrden, the information technology director for the Department of Workforce Services, as Fletcher's replacement.

Herbert also appointed Sheila Walsh-McDonald to the new post of health data security ombudsman. She will oversee individual case management, credit counseling and public outreach.

Penetration Testing Business Methodology

A high quality penetration testing engagement that provides the best value to the client requires a rigid business methodology on the part of the penetration provider.  The methodology begins a long way from any exploits. It begins with documents vetted by legal. For the client soliciting the testing this includes a statement of work (SOW), request for proposals or quote (RFP/RFQ).  The penetration testing provider creates a formal technical and cost proposal in response to the solicitation. If selected to perform the penetration test, the provider negotiates a contract draft which is vetted by legal and the formal contract is signed by both parties. Other documents vetted by legal and signed by both parties are: non-disclosure agreement (NDA), and an indemnification agreement or "get out of jail free document".  Sub-processes of all this paperwork include checklists of what the client permits and does not permit the penetration tester to perform. Another document more akin to the penetration testing team's internal document that may be shared with the client is the work breakdown structure (WBS) and project schedule (using Microsoft Project or something similar). The WBS outlines for the "tiger team" and the client the timelines, milestones, work to be performed, deliverables, etc. as the testing progresses.  The project schedule is a scheduling tool used to plan and monitor the progression of the work.  Disciplines ideal for the business methodology to be successful are:  project management skills such as knowledge base from Project Management Institute, government and commercial contracting methodologies, and knowledge of various computer and information systems laws and regulations by country and state. It is paramount for both parties to obtain legal representation from law firms that have knowledge of government and commercial contracting. The law firm does not have to have specific knowledge of penetration testing contracting although it would be helpful if they had helped write and had vetted those contract types.

US Cyber Guard

The US Cyber Guard Begins

Thursday, May 17, 2012

Contributed By:
Joel Harding

According to a Reuters report, US cyber defenses will now include more than just the US Cyber Command and the Department of Homeland Security.  Eventually it may include somewhere around 8,000 contractors, mostly defense contractors.
These two paragraphs illustrate the reciprocal relationship between the US government and cooperating contractors:

The Pentagon on Friday invited all of its eligible contractors to join the voluntary pact aimed at fighting what U.S. officials have described as growing cyber threats that allegedly originate, above all, in Russia and China.
The Defense Department will provide intelligence-derived information on malicious Internet traffic to the companies; the firms are to share information on any cyber penetrations of their networks with the government.

The proof of concept for this program began in 2007 and is now being expanded, initially with 1,000 contractors, and then growing.
Three ISPs, believed to be Verizon, AT&T Inc and CenturyLink Inc, are providing “filtering and remediation”, essential services to intelligence sharing.
Of course the conspiracy theorists will begin screaming “big brother” in…   3, 2, 1…   but I would rather have our government try to protect us from future cyber attacks which could be devastating to our economy, our way of life, to almost the entire world as we have become used to it.

Always Learning SQL injection

IT Security and penetration testing is a challenging discipline and I learn every day.  Some days it does not dawn on me that I learn or register in my brain that I have learned something. Today was different. I have been somewhat discouraged about my prowess for performing a good sequel injection.  Today that was made a little clearer by reviewing my ECCouncil CEH course material and my elearnsecurity course material on error-based and blind sql injection.  I learned that ONLY MS SQL is vulnerable to error-based sql injection because it is programmed to give out verbose errors essentially telling the ethical hacker or otherwise almost everything about the constructed database. MS SQL gives nice little hints like "you have a syntax error in your MS SQL "SELECT" statement at "first_name" FROM "credentials" which tells you that your syntax is wrong while trying to select the first_name of someone that is in the "credentials" database. So it is necessary right off to identify the type of the SQL server.  If the server is MS SQL, then it could be vulnerable to all types of sql injection. If it is mysql, postgresql, Oracle, DB2 then it is NOT vulnerable to error-based so try another type of sql injection.  Error-based on MS SQL is fairly easy to do manually.  Blind injection is extremely difficult and time consuming to do, if not impossible, to do manually.  For blind injection there are some good tools. One of the best is SQLMap and Pangolin.  Another is Hajiv.  There are some others but those listed are my favorites. The trick in using all the tools is you have to find an injectable parameter that would be kin to a form field for user input. The web URL might look something like:  http://vulnerablesite/index.php?products/id=3.  This is a form asking the user to input an id for a product with a number of 3. This URL may communicate with a back-end database "products" that contain an id integer column and a description column and probably a UPC code and any other product identifiers.  The whole string of http://vulnerablesite/index.php?products/id=3 would go into the URL address bar in SQLMap, Hajiv or Pangolin. The injectable parameter is "products/id=3"  The sql tools listed also require configuration input of as much as known about the databases of course the type, eg. mysql, MSSQL and so forth. You can use a GET or POST request and then you choose error based, blind, or time based and let the tool do the work to dump the data from the database columns. 

Zeus Trojan

Zeus P2P variant against Facebook,Hotmail,Yahoo & Google Mail

by paganinip on May 17th, 2012

The experts of Trusteer firm have discovered a new variant Zeus malware responsible of  a series of attacks against principal internet service providers. The variant carried out attacks using the P2P network architecture targeting users of Facebook, Hotmail and Yahoo and  Google Mail.

What is Zeus?

The Zeus Trojan is one of most notourios malware that we have found in several cases, we can consider it as one of the better products of the malware industry. The malware is really appreciated by cyber criminals that have improved its feature over the months. Zeus Trojan is born as an agent able to steal banking information by logging keystrokes and form grabbing, it is spread mainly through phishing and drive-by downloads schemes.
With an eye on the malware distribution model and support services, commonly referred to as “software-as-a-service”, I point out the ZeuS offshoot, Citadel, to true web store advertised on several members-only forums that proposed malicious hackers developments .
Recently I reported the news on the commercial distrubution of the famous Zeus Trojan, a malware designed as an open project that can be customized with new features to meet customer demands. Consider that the several Zeus botnets are estimated to include millions of compromised computers (around 3.6 million in the United States). As of October 28, 2009 over 1.5 million phishing messages sent on Facebook Were with the purpose of spreading the Zeus’ Trojan . Regarding ZeuS diffusion I suggest the consultation of the web site https://zeustracker.abuse.ch/ that provides updated statistics on the localizzation of the Command&Control servers of the botnet based on the agent. Between the huge quantity of statistics presents I have found a couple of issue that I consider really indicative the Average Antivirus detection rate (last 60 days) and the list of the Top C&C servers.

The  schema of the new scam

The principle used to trick unsuspecting users is simple, the cyber criminals behind the malware with the intent to steal user’s debit card data, have offered discounted product through the famous platform. The malware relies on the psychological conditioning of the user that seeing attractive discounts offered on the famous platforms is pushed to believe them as genuine.
The scams exploit the trust relationship between users and these well-known service providers, as well as the Visa and MasterCard brands, to steal users’ debit card data. Let’s in details the features of the principal attacks observed.
The malware variant that hit Facebook uses a web injection mechanism to propose to the  victim a special price reduced of 20% for purchases made with Visa or MasterCard debit card using their Facebook account. The scam promises in fact that after registering debit card information, the victim will earn cash back when they purchase Facebook points.
Of course to the user is proposed a form for the registration of debit card info that is equivalent to a legitimate one also in term of proposed layout.

A transaction using Verified by Visa/SecureCode will initiate a redirect to the website of the card issuing bank to authorize the transaction. Each issuer could use any kind of authentication method (the protocol does not cover this) but typically, a password-based method is used, so to effectively buy on the Internet means using a password tied to the card.
Different schema has been implemented in the attacks against Hotmail, Google Mail and Yahoo users, in this cases Zeus variant offers an new way of authenticating to the 3D Secure service offered by the Verified by Visa and MasterCard SecureCode programs.
3-D Secure is an XML-based protocol designed to be an added layer of security for online credit and debit card transactions. It was developed by Visa with the intention of improving the security of Internet payments and offered to customers as the Verified by Visa service. Services based on the protocol have also been adopted by MasterCard, under the name MasterCard SecureCode.
The basic concept of the protocol is to tie the financial authorization process with an online authentication. This authentication is based on a three domain model (hence the 3-D in the name). The three domains are:

1. Acquirer Domain (the merchant and the bank to which money is being paid).
2. Issuer Domain (the bank which issued the card being used).
3. Interoperability Domain (the infrastructure provided by the card scheme, credit, debit, prepaid or other type of finance card, to support the 3-D Secure protocol).

The protocol uses XML messages sent over SSL connections with client authentication (this ensures the authenticity of both peers, the server and the client, using digital certificates).
The malware operates in the phase of the online transaction used by merchants to require cardholders to authenticate using their personal 3D Secure password.
In the scam that circumvents Google Mail and Yahoo users claims, the customer is convinced that linking his 3D code to the mail account making it available for future purchases. The malware propose a sort of single sign on schema, convincing the user that simply registering its data on the mail platform he wil be able to perform purchases logging to its email account using the protected services Google Checkout and Yahoo Checkout.
The advantage proposed to the user is of course a secure channel for his online transactions. Also in this case is proposed to the user a fake page to collect the victim’s debit card information reporting the logos of Visa and MasterCard circuits.


A similar schema has been adopted also against Hotmail offering a free new security service.

A multi purpose malware

Zeus is undoubtedly one of history’s longest-running malware used for different purposes, just remember that the dangerous malware was used to strike the hacktivists of Anonymous. On that occasion, a modified variant of the tools used in the attacks infected with Zeus malware, in this case the tool Slowloris, was spread using the standard channels as Pastbin. The hackers have copied and pasted an original entry Pastebin Anonymous Replacing the download link with an infected version. In this way the agent was extremely rapid diffusion.
The example is purely demonstrative, we don’t know who is behind the hack, but what really worried about is the extensive use of malware by cybercrime an governments for operations of cyberespionage.
The approach pursued for these agents is evolutionary and permanently eradicate a threat that evolves over time in unexpected ways in the future will require an increasing effort.
Pierluigi Paganini