SecurityFeed.info » WabiSabiLabi's blog

« Expand/Collapse

WabiSabiLabi's blog (10 unread)

October 14, 2008
14:09
The babies are born!
» ‎ WabiSabiLabi's blog

Long time has passed since the last post in our blog. Were we sleeping?
Not really.
We were just busy in cooperating with OneShield UTM manufacturer and we were thinking that facts are better than words.
As previously announced online and through conferences, WabiSabiLabi was selected by Delemont Technology as a 0day signatures contributor for a new generation of UTM (Universal Threat Management) appliances.
You'll be able to find all the technical details here.

There are already four different models of OneShield UTM appliances, they are all ready to be deployed to defend your network and a fifth one is on its way. As you can see from the pictures below, the appliances are now a reality, thanks to the effort of Delemont Technology (located in the Venice Gateway for Science and Technology) which is the owner of the OneShield brand, the Eurotech Group, which is the hardware provider and WabiSabiLabi backed up by the private security researchers community, which will contribute to the applaince 0day signatures packs.

More details about the appliances and the security researchers rewarding scheme behind them will be disclosed at the HITB security conference (Oct. 27th - 30th - Kuala Lumpur - Malaysia), where curious people, journalists, prospect clients and distributors will be able to touch them.

Meanwhile, enjoy them in a live test installation.

For more information about the OneShield UTM appliances you are welcome to contact OneShield's Development Manager Mr. Alberto Boratto: a.boratto [at] delemont.com
May 09, 2008
14:59
SecurityFocus: we can't believe our eyes
» ‎ WabiSabiLabi's blog

Recently on SecurityFocus (read: Symantec) appeared an article written by Jamie Reid, a privacy, security and risk consultant to healthcare agencies in Toronto.

While reading the article, we could not believe our eyes. In a nutshell, the article is brilliantly demonstrating why the current level of money offered by traditional security vendors to security researchers (yes, somobedy finally used the proper term) for their 0day findings is not representing the real value of them. No need to report here SecurityFocus columnist's ideas backing up such statement, we totally agree with them, especially with the final part which is stating that perhaps, the proper model should be a model including a sort of revenue sharing scheme. Just go and read the article.

But... there is a but. To demonstrate that the traditional security vendors' model is not providing a proper value to the researcher's efforts, the columnist wrote:
"Competitors in the bug-buying space like WabiSabiLabi's auction scheme, and iDefense's VCP offer lower rewards, but provide different structured incentive packages for disclosing 0-day exploits to them."

Initially, we didn't pay much attention to it, but then... questions started to pop up in our mind.
As everybody knows, stating something like "Competitors in the bug-buying space like WabiSabiLabi's auction scheme(...) offer lower rewards" is actually not representing the reality. In fact, WabiSabiLabi doesn't offer ANY sort of reward at all. We just provide a marketplace, where the reward level is the natural result of the interaction of offer and demand. Why the need to say that WSL itself is providing low reward to researchers? It puzzled us.

Then we paid attention to the fact that the columnist is wishing for security researchers a sort of revenue sharing model, deliberately (?) forgetting to mention that WabiSabiLabi announced such scheme since the time of its very foundation. Go and read our almost-one-year-old post.

At that point, we mailed to Jamie Reid, pointing out the fact that we were not providing "low rewards scheme" and that we were already promoting since a year our revenue sharing scheme, hoping that he would have corrected his article.
Guess what? We received a polite mail in which he answered "Thank you. That's an interesting model. I will be interested in following up in a year or so about how it is working". But no amendments on his article.

A distracted columnist? Or perhaps an anticipation of a future Symantec's move toward a different approach in the security research industry?

As you know, we are working hard since one year in the realization of such rewarding scheme, having initially half of the world against us. Our efforts are concretizing in the recently announced partnership for the production of the UTM OneShield Security, which will integrate a revenue sharing model, for those security researchers who are contributing with their findings.

We took all of the risk and heat, we faced the shadiness of the current laws, we took all the insults from that part of the researcher's community which didn't agree with us, we standed strong hits from some lobbied press.
Nevertheless, we are still alive so it might be the right time from the big industry to take advantage of the results of our work?

We'll see. It will be interesting for us, to see how our competitors (who much criticized our model, defining it unethical) will find excuses to adopt it.

Our forecast? Perhaps they will adopt only part of it. They won't adopt the auction part but they will eventually adopt the revenue-sharing scheme.

With a problem: it will be the demonstration that they abused of the work of the security researchers, paying them peanuts, up to the moment somebody popped out of the blue and forced them to adopt new business models, in which security researchers are not anymore considered as freebies or peanuts workers.

Please remember... that somebody, was us.
May 08, 2008
1:41
Are South Africans aliens from another planet?
» ‎ WabiSabiLabi's blog

They must be, at least this is what we think after being invited to hold a keynote speech at the ITWeb Security Summary 2008, (Johannesburg - South Africa), and after having checked the reaction of the attendees at the end of it.

Let us get it straight: the speech was about WabiSabiLabi's marketplace project and it was held in front of a crowd of 400 attendees.
At the end of the speech, the conference host fired up a question to the crowd:"Who think that WSL is doing the right thing in providing a marketplace for security research, raise the hand".
We panicked waiting for the response but then ... 399 hands attached to security professionals' bodies were raised.
To counter-check, the host asked then: "Who is against such initiative?". Only one hand up.

Are we THAT good in selling ideas? Or maybe it's just the marketplace idea itself that, when supported by proper motivations, doesn't find any difficulties in being adopted or even supported by security professionals?

Or is it that South Africans are aliens from another planet? We are still wondering...

Meanwhile, a few words about the ITWeb conference. We are always bragging how good the Swiss are in organizing things. Well, they have indeed some good competitors in South Africa. The ITWeb conference is a top international event, period.

Pros, Cons and Kudos

Pros:
Symantec's "free of charge" espresso coffee machine at their booth. Finally, some good hardware.
Thanks a lot, from the deep bottom of an Italian heart.

Cons:
ITWeb's catering service. We have the proof that aliens don't know how to properly cook pasta.
Yes, boiling it for less than two and a half hours will also help to spare Africa's energy resources and will contribute to lessen the power outages.

Kudos:
Johnny Long for his fabulous speech and his charity initiative. People, vendors...what are you waiting for to support it?
Johnny Cache, for being so... smurky. He knows what we mean ;)
Dino Covotsos, for being a good friend and for sponsoring through his company Johnny Long's charity initiative.
Kudos also to the Serbian community, Paul, Janine, Alissa, Mariette, Ilva and all the new and old friends we found over there.

Final round of kudos to South Africa, for giving us such dramatic sunsets.

From Earth, over.
May 06, 2008
11:08
Partnership announcement with OneShield Security
» ‎ WabiSabiLabi's blog

WSL is proud to announce a partnership with OneShield Security for the production of a UTM appliance. The appliance will intergrate a 0day preemtpive engine, based on the knowledge coming from WSL's marketplace and will be based on hardware provided by Eurotech, a defense, security and aerospace hardware producer.
The partnership is already in its second-phase which means that in a few weeks the product will be available for the mass-market (projected date: June 1st 2008).

In the next two blog posts we will announce how the security researchers community will benefit out of the OneShield Security network and also another strategic partnership in the security research area.

The appliance will be bundled with an optional Managed Security Services package, and will have the following characteristics:

Network Security:

- Stateful Packet Firewall
- Demilitarized Zone (DMZ)
- Intrusion Detection
- Multiple Public IPs
- Traffic Shaping

-- VoIP/SIP support
- Malformed Packet Protection
- Portscan Detection
- DoS and DDoS Protection
- SYN/ICMP Flood Protection
- Anti-Spoofing Protection

Enterprise IDS:

- Fully Web Managed Intrusion Detection System
- Integrated with the largest Networks of 0Days Threats in the world
- Ajax Instant Log Web Interface for instant alerting of Intrusion Attempts

Web Security:

- HTTP & FTP proxies
- Anti-virus (100.000+ patterns)
- Transparent Proxy support
- Content Analisys/Filtering
- URL Blacklist
- Authentication: Local, RADIUS, LDAP, Active Directory
- NTLM Single Sign-On
- Group Based Access Control

Mail Security:

- SMTP & POP3 proxies
- Anti-spam with Bayes, Pattern, SPF, Heuristics, Black- and White-lists support
- Anti-virus (100.000+ patterns)
- Transparent Proxy support
- Spam Auto-Learning
- Transparent Mail Forwarding (BCC)
- Greylisting

VPN Concentrator:

- True SSL/TLS VPN (OpenVPN)
- IPSEC
- Encryption: DES, 3DES, AES 128-, 192-, 256-bit
- Authentication: Pre-Shared Key, X.509, Certification Authority, Local
- PPTP Passthrough
- Native VPN Client for MS Windows, MacOSX and Linux

Hotspot Security:

- Captive Portal
- Wired/Wireless support
- Pre-/Post-paid and free Tickets
- Integrated RADIUS service
- Connection Logging
- No additional software/hardware required

Management:

- Easy Web-based Administration (SSL)
- Secure Remote SSH/SCP Access
- Serial Console
- Centralized Management through Endian Network (SSL)

High Availability:

- Multi-Node Appliance Cluster
- Hot Standby (active/passive)
- Load Balancing (active/active)
- Node Data Synchronization

WAN Failover:

- Automatic WAN Uplink Failover
- Monitoring of WAN Uplinks
- VPN Failover

Network Address Translation:

- Static NAT (Port Translation)
- One-to-One NAT
- IPSec NAT Traversal

Routing:

- Static Routes
- Source Based Routing
- Destination Based Routing

Logging/Reporting:

- Instant Log Viewer (AJAX based)
- Detailed User Based Web Access Report
- Network/System/Performance Statistics
- Syslog (Local or Remote)

Updates and Backup:

- Centralized Updates through Oneshield Eurotech Network
- Anti-virus Definitions
- URL Blacklist Definitions
- Scheduled Automatic Backup
- Encrypted Backups via E-mail
- Instant Recovery/Backup to USB-Stick
April 18, 2008
15:36
Addendum to :"Letter to the community"
» ‎ WabiSabiLabi's blog

After my recent post on this blog about the ethical dilemma that pushed me to think if I should stay or leave WSL, followed by the motivations about my decision to continue to support the project, the international press has republished excerpts of my words in the articles that followed.
Those excerpts have been in most cases interpreted correctly, I am referring to that part in my post in which I tried to describe the outlines of the big case that brought me troubles.
Specifically, with the words:

"The case for which I was arrested it's actually a huge case and believe me, no single news agency was able to picture it completely right. Probably, nobody will ever be able to picture it completely right as it's a case involving a hundred of arrested people, the Italian Secret Services, the US Secret Services, some Italian corrupted police and financial police officers, some Italian and US investigation companies, a multi-billionaire struggle between Telecom Italia and Brasil Telecom, an extraordinary rendition (kidnapping) of a presumed Islamic terrorist, and last but not least, the suicide (but many say murder) of a Telecom Italia Security top manager. Aside this, the various attempts of the Italian government to take over the control of the Italian main telecommunication carrier."

I didn't report facts known to me personally, but a short recap of the case as it was reported by the Italian press. In fact, my personal case is loosely connected to the whole, big Telecom Italia case that appeared, for nearly two years on Italian newspapers, as a case which borders are not easily identifiable.

In one specific case though, an Italian columnist of the "Il Sole 24 Ore" newspaper has interpreted my words, in the typical way of the Italian scandalistic journalism, raising suspects on the possibility that I could be the guardian of who-knows-what secrets related to the case.

No, I am not the guardian of any secret. If a was, I would have not written those words. I just reported what the Italian newspapers wrote, following the Italian investigators' findings. Within my drawers there are no secrets, on the contrary, I wish I'll be able to forget this case, which greatly damaged my personal life and professional career.
April 10, 2008
19:54
Roberto Preatoni - Letter to the community
» ‎ WabiSabiLabi's blog

One year has already passed, since the moment the WSL crew started to work on the marketplace project, as it went public on July '07, but a lot of preparation work has been done since several months before.
As you well know, the marketplace gained immediately a quite impressive press coverage, splitting (as we were expecting) the security world in two: those who praised the project and those who hated it.

Generally speaking, whenever you succeed to split the world in two, it's a sign you are doing the right thing. Absolute positiveness it's usually an indication that a sort of monopoly or dictatorship is ruling the game, brainwashing the thinkers.
I already know, even this post will split the world in two.
Honestly, WSL was expecting even more criticism, at least in the beginning, thus we can't deny we are quite satisfied by what the project achieved in the last months.

But eventually WSL had a problem.
Sorry, I had a problem.

The news of my arrest broke through the press titles causing havoc among WSL and the people who started to put some trust in it.
Right, trust. That's the word without which, no project such ours could ever take off.

The case for which I was arrested it's actually a huge case and believe me, no single news agency was able to picture it completely right. Probably, nobody will ever be able to picture it completely right as it's a case involving a hundred of arrested people, the Italian Secret Services, the US Secret Services, some Italian corrupted police and financial police officers, some Italian and US investigation companies, a multi-billionaire struggle between Telecom Italia and Brasil Telecom, an extraordinary rendition (kidnapping) of a presumed Islamic terrorist, and last but not least, the suicide (but many say murder) of a Telecom Italia Security top manager. Aside this, the various attempts of the Italian government to take over the control of the Italian main telecommunication carrier.

Well, right after my arrest, I clarified my position and the Court of Freedom ruled for my release a few days after. Of course, no press coverage in this case but hey, that's the way it works. At least, next time I'll meet Kevin Mitnick at TJI Friday's I'll have something to say and not only to ask.

But the damage to WSL was done and there was nothing I could do to repair the cracks. The questions I kept asking myself in the last months were: What will happen to WSL if I will stay? Will my private life and troubles effect negatively the project? Should I keep representing publicly the project?
Several people, including security researchers mailed me addressing the same questions (thanks, Jesper) forcing me finally to take a decision.

I will stay.
I will stay and continue to put pressure to security lobbies. Things must change, researchers and their discoveries should be considered beneficial to the whole security cycle.

I'll represent WSL once again, in the next planned security conference (6-7-8 May 2008, Johannesburg - South Africa). I'll be there, you are welcome to come and kick in harsh questions related to the project, I'll try to do my best to answer to you.

One more thing. We worked hard on a partnership that we will announce soon. It'll be a surprise and it'll effect positively the marklet-place and the cash the researchers might be able to get.

Yours faithfully,

Roberto Preatoni
March 07, 2008
15:15
Chinese shopping @ 3Com
» ‎ WabiSabiLabi's blog

This article have been posted originally on Zone-H.org, but I find it valuable also in regard of WSL' mission...

Bain and Huawei's $2,2bn first attempt to buy out 3Com has been amended with a second offer, under which the Chinese networking giant and the Investment Fund plan to gain control of the American networking giant, but having "limited access" to 3com's security products. This amendment has been introduced after the Treasury's Committee on Foreign Investments launched an investigation aimed to block the deal, fearing possible implications in having a Chinese company so much close to key security products, currently used by the American government's IT infrastructures. Further skepticism was raised by those who didn't forget that Huawei's founder Mr. Ren Zhengfei was also a former Chinese People Liberation Army officer...
As a security professional, I am involved in the WSL startup, the company which is aiming to re-design the security research market cycle, introducing the concept of an open auction marketplace through which the security researchers' job should be properly valued. When the Swiss-based WSL project was launched, several observers labeled it as "controversial" or in worst cases as "fishy". "Who the hell are they?" - "They might be a front-end of a criminal organization" , words were spent.

Eye-browses were raised even by the same Tipping Point, the security company belonging to 3Com, which is currently purchasing 0day exploits from researchers.
Speculations on the opportunity of letting a Chinese company purchase Tipping Point (which sells intrusion prevention technology to the US government) through the 3Com buyout are too easy. Actually the discussion is still open as apparently Huawei proposed to spin-off Tipping Point before the completion of the 3Com acquisition procedures.
Regardless this latter proposal and the related market's reaction which might or might not welcome this marriage between IT giants, we should all be concerned about the possible implications in having a Chinese networking company controlling one of the largest western producer of network and security appliances.
Here both stakes and risks are too high.

The question is: WHO OWNS YOUR DATA?

If your answer to this question was "ME", then we are sorry to wake you up abruptly from your dreams. The owners of your data are (in order)

1) the producer of the network hardware, who knows very well that all the today's companies rely on the data transmission through the Internet. Your data might be secret, securely stored and encrypted, but sooner or later they WILL pass through a sort of network appliance (being it a network card or a router). The only entity which can certify what was embedded at the hardware level (read: spyware-free) in such network appliances during the production process.... is the same hardware producer.
2) your ISP, as most of your data are transmitted in clear, therefore interceptable
3) the government, as data retention laws are getting tougher and tougher
4) your data-center administrator, who might decide to run away with your data.
5) the hacker, who probably already compromised your data-center and is comfortably sitting on your hardware since a couple of years
6) ... probably you.

What's the menu today?

America's network cards in Tze Chuan sauce?

No, thanks.
December 19, 2007
19:24
Focus On: MySQL remote code execution
» ‎ WabiSabiLabi's blog

Christmas is coming and Santa brought us a new interesting vulnerability about another database system: today it's the turn of one of the most spread and used RDBMS, MySQL.

MySQL 5 is in fact prone to a remote command execution vulnerability.

This vulnerability has been tested on Linux, with MySQL versions 5.0.45 and 5.0.51, the latest one.

This is a pre-authentication vulnerability so you won't even need a valid username and password but a GRANT from your IP on the database, to let the connection start.

Like all the database softwares, you won't find so many MySQL's exposed on the internet, while it can be very common in a Local Area Network.

Also, MySQL is often used in web application development, so most (all?) of the web hosting providers sell access to the MySQL server together with the web space.

By exploiting this vulnerability you will be able to access the content of all the databases present on the DBMS without needing a local privilege escalation since the files on the filesystem containing the database data are owned by the same user running MySQL.

If you buy this vulnerability you will receive a fully working PoC and all the technical details.

Of course, for further information don't hesitate to contact us via e-mail, and if you want to make a bid on the vulnerability, do it here.
December 10, 2007
16:44
Focus on: SAP MaxDB remote code execution
» ‎ WabiSabiLabi's blog

A very interesting vulnerability appeared a while ago on our marketplace and it's now time to give it the visibility it deserves.

Today we are in fact going to focus on a remote command execution vulnerability in SAP MaxDB (you can bid on it here).

The vulnerability has been triggered on Linux machines running SAP MaxDB version 7.6.00.37 (that's the lastest version) and 7.4.3.32, and on Windows machines running SAP MaxDB 7.6.00.37. Other versions may also be affected.

This vulnerability is also pretty easy to exploit: just send a specially crafted request, containining an arbitrary command, to the listening port of the vulnerable MaxDB service and that command will be executed with the credentials of the user running the process (usually 'sdb' on Linux).

Yes, you can figure that a database service is rarely open on the Internet, but in a LAN it's not-so-rare to find so this vulnerability is pefect in a variety of corporate pentesting scenarios.

As you know, SAP AG products run on the majority of intranets of the biggest companies all around the globe and all the products developed by SAP AG are focused on Enterprise Resource Planning (ERP).

Of course, every SAP applications that requires a Database service will use MaxDB RDBMS.

The situation can be really alarming if you sum all of the factors described above: easiness of exploitation + remote access + spread of the product + confidentiality of the data contained into the database. The result can be scary.

Once you can execute commands on a machine running MaxDB, with the credentials of the MaxDB user, it's very easy to dump the content of the whole database.

Together with the vuln you will also buy a fully working and reliable PoC.

Hopefully this post will be able to help both the companies running this vulnerable SAP product by rising their awarness and the security companies looking for better tools.
November 30, 2007
18:24
WabiSabiLabi Walkthrough
» ‎ WabiSabiLabi's blog

Hello folks, since we received a lot of questions about the whole marketplace procedure we'd like to point out some of our policies.

First thing, the researcher needs to sign up to our website: from this point on he can start submitting his work to the lab.

Please note that before selling anything, he'll be asked to fax or email his ID card details and a landline phone number, that we'll use to verify his identity.

We usually need full details about a vulnerability, so we might start a direct correspondence with the researcher, if necessary. Every communication is encrypted with PGP/GPG (here's our public key).

Once we get all the required details we can start testing the vulnerability.
Even if we are doing our best to speed up this part of the process it still requires some days: you can help us by sending as much information as you have about the vulnerability, i.e. debugger output, commented proof of concepts and step-by-step methods to trigger the vulnerability, in case it's a complicated vulnerability to exploit.

Despite our dedicated entry in our F.A.Q. page we are often asked which vulnerabilities we will accept or reject:

- all vulnerabilities related to network services, network clients, standalone clients, web applications and network devices are accepted and tested.

- we DO NOT accept vulnerabilities in specific websites, like for example eBay, Gmail, Hotmail, online casinos etc.

Once the vulnerability has been tested and accepted, we decide a starting price and a selling strategy together with the researcher, who will then receive our NDA. This must be returned signed, via fax or mail.

At this point we are ready to publish the vulnerability.

When the vulnerability is sold we will pay the researcher via paypal to his verified account or via wire transfer to his bank account.

If you want to be a bidder all you have to do is subscribe to our portal and provide the papers required to check and verify your identity. Please note that we only accept payments coming from a verified bank account in your name.

That's all.

Our purpose is raising awareness and reducing risk and contributing to the research of new vulnerabilities by both helping and protecting researchers and giving them appropriate compensation for their amazing work.

← Uninformed Journal WatchGuard Wire →

SecurityFeed.info » WabiSabiLabi's blog

Feeds

WabiSabiLabi's blog (10 unread)