SecurityFeed.info

« Expand/Collapse

pwn* (10 unread)

July 24, 2008
21:05
Kaminsky on DNS... patch it
» ‎ pwn*

var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));

var pageTracker = _gat._getTracker("UA-5013017-1");
pageTracker._initData();
pageTracker._trackPageview();

Well, well, well... couple of posts for you to see if you haven't been following me at my main blog over at ZDNet. Follow up from Dan's webcast, and an analysis of the second exploit released by Metasploit for the DNS vulnerability.

http://blogs.zdnet.com/security/?p=1552
http://blogs.zdnet.com/security/?p=1546

Go go gadget pwn!

-Nate
July 09, 2008
1:52
Big day for security news
» ‎ pwn*

var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));

var pageTracker = _gat._getTracker("UA-5013017-1");
pageTracker._initData();
pageTracker._trackPageview();

What a huge day for security news! You had Microsoft releasing four bulletins covering nine vulnerabilities, with one of those being Kaminsky's apparently huge multi-vendor DNS hole that promises some absolute ninjitsu on display at Black Hat Vegas. Then you had comments from Tom Ptacek and others saying that the Kaminsky vulnerability may be overblown, which resulted in a great interview of both Kaminsky and Ptacek for me. Finally, the day closes with Microsoft dropping a late-breaking advisory covering concerns over attacks reported in the wild allowing arbitrary code execution on Office 2002 SP 3.

WHEW! What a day! I probably got carpal tunnel from all the typing.

-Nate
July 03, 2008
1:39
Facebook XSS Vulns
» ‎ pwn*

var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));

var pageTracker = _gat._getTracker("UA-5013017-1");
pageTracker._initData();
pageTracker._trackPageview();

Well, not that it's probably unexpected, but a number of cross-site scripting vulnerabilities were reported on Facebook today on Full-Disclosure. Mm... yeah, Social Networking sites. The hotness of XSS exposures for their huge deployment capabilities.

Read the details on my ZDNet blog, here.
July 02, 2008
18:44
Updates on my main blog
» ‎ pwn*
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));

var pageTracker = _gat._getTracker("UA-5013017-1");
pageTracker._initData();
pageTracker._trackPageview();

For those who haven't noticed, I blog here less and less, but I still want a place to keep any tools or PoC exploits I decide to release, so it's still here. I wanted to draw attention to a few of my recent postings over at ZDNet which I think some of my readers here will find fun if they aren't reading me at ZDNet already.
- Tiller Beauchamp's Review of the Recon 2008 conference - By the way, go read his killer blog over at POP/POP/RET.
- McAfee S.P.A.M. Experiment and more HackerSafe Failures
- Awesome Research on Cellular Interference by Pedram Amini and Cody Pierce of Tipping Point
- Big Brother Getting Bigger...
- An effective way to treat Web 2.0 vulnerabilities
Keep your eyes open for a guest editorial from David Weston as soon as I can get him to stop being lazy... er I mean, until he gets settled into the new jobby job at Microsoft.

-Nate
June 23, 2008
13:07
90% of all statistics can be made to say anything... 50% of the time
» ‎ pwn*

var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));

var pageTracker = _gat._getTracker("UA-5013017-1");
pageTracker._initData();
pageTracker._trackPageview();

My thoughts on the Verizon Data Breach report.

You know what I would've loved is if they had some numbers around technologies employed at some of these companies for protection. I wonder how well companies with WAFs fared against Web App issues?

More importantly, I wonder how many of these systems were marked PCI compliant... food for thought.

-Nate
May 16, 2008
14:04
Don't read this unless you want to laugh for an hour
» ‎ pwn*

OK, posted another story beating the dead horse that is McAfee's HackerSafe on my ZDNet blog. It is hilarious, you should have a look, and hey, if you want to certify, let me know.

Video linked here for added laughs.

-Nate

BTW, my site is:

IS YOURS?
April 17, 2008
15:49
Major blow to the enforcement of security
» ‎ pwn*

Wow, what a day...

The PCI clarification came out and the way it read to me sounded like you could just use a web application firewall going forward and you would be 100% compliant. What an absolute joke! As if PCI wasn't laughed off by most security experts already, now I know it means nothing to keeping an organization secure.

Let me point out, WAFs are getting better at what they do, but they don't do everything. There's a ton of issues that WAFs cannot protect you from. I cover that on my ZDNet blog, but I found it interesting to mention my good friend Nitesh Dhanjani's recent post.

Nitesh suggests that if you are secure, you will be compliant. What a novel idea that is! If you manage to achieve security, then you will be compliant with the compliance model that actually intended to make you secure in the first place. Funny how this new clarification to PCI has effectively not made that statement interchangeable. If a WAF is all that is required to protect a company's web application per the PCI guideance, then the PCI guideance does not achieve its goal of making a web application secure, and that is really quite sad.

I hope that companies will ignore this second option in favor of having a web application and possibly a Secure SDLC put into place, but I feel that compliance is driving security, not the other way around.

-Nate
1:13
The Sickest Thing I've Seen This Year
» ‎ pwn*

This is old news now to some, as Rios already mentioned it on his blog... but I just had to talk about it. If you haven't read this document at least 20 times by now, you are missing out.

I'm talking, of course, about Mark Dowd's null pointer dereference exploitation. I got a bit of a breakdown on my ZDNet blog that points all over the place to the experts on the subjects take.

I may try to get an interview with Dowd on the subject.

-Nate
April 09, 2008
22:33
DNS canonicalization issue leads to DNS rebinding attack
» ‎ pwn*

Today Adobe patched several issues in Flash, including one that Rob Carter and I (see the picture below) originally reported. The issue takes advantage of a discrepency in how IE and Flash each handle a normal DNS request and a full canonical (I might be using that term wrong) DNS name.

So for example, Flash treats natemcfeters.com and natemcfeters.com. as the same domain... rightfully so. Most browsers, however, will make two separate DNS requests, one for each hostname, thus leading to the DNS rebinding attack. This is actually the exact attack we used to steal images from Picasa.

I've posted more details on my ZDNet blog, so you can see the nitty grittys of it there.
April 01, 2008
11:30
Speaking at ToorCon Seattle!
» ‎ pwn*

Rob Carter and I will be speaking at ToorCon Seattle on April 18-20, so if you are in town, shoot me an email and we'll catch up.

I'm totally stoked for this conference. I seem to have the most fun at ToorCon cause it's just so laid back. Tons of friends will be around for drinks, my girl (Melissa Radocha) is coming with me and it's going to be a blast! We'll be hanging out with Billy Rios and his wife Donya, Dan Kaminsky, Brett Hardin, Jay Kelath, and of course h1kari himself.

Not to mention that there's some really great looking talks. I'm really excited to see John Heasman's talk "Wake up and smell the coffee!", as well as Matt Miller's talk on "State of the Exploit", Adam Shostack's talk on "SDL Threat Modelling: Past, Present, and Future", as well as several others.

If you are out in the area, or are thinking about coming, drop me a line!