Power Hacker 2003

home *** CD-ROM | disk | FTP | other *** search

/ Power Hacker 2003 / Power_Hacker_2003.iso / E-zine / Magazines / default / default4.txt < prev next >

Wrap

Text File | 2002-05-27 | 84.2 KB | 1,720 lines

Default newsletter Issue #4 http://default.net-security.org 05.09.1999 Help Net Security http://www.net-security.org TABLE OF CONTENTS ----------------- I. Editorial II. Last weeks news on Help Net Security a) Help Net Security news headlines b) Vulnerabilities reported in last week c) Site News d) Defaced Pages III. Description of the Millenium problem IV. A look into basic cryptography V. Telecom 101: Receiving through the serial port VI. Macintosh security: Security audit with our Mac VII. Computing: Matrox G400 MAX Review VIII. Understanding basic crypto techniques IX. Infection & Vaccination X. New programs on Net-Security (NS Watch!) XI. More news from the ACPO front XII. The Hotmail security hole XIII. Meet the underground XIV. Freedom of speech - related incidents XV. Microsoft Installs US Spy Agency with Windows I. Editorial ------------ Hi there and welcome to yet another issue of our Default newsletter. A bit late, but brought straight to you from the Hit2000 Con (http://www.hit2000.org). Ok, I (Thejian) am going to kick off with some issues regarding the organization of Default. We would like to hear your (the readers) opinion on them, because that's the only way for us to make this thing work (even better :) to your liking. A lot of our editors do have lives outside the Internet (yeah don't ask me why or how but..) and it has shown to be pretty difficult to expect them to come up with articles and columns on weekly basis. We thought of 2 ways to battle this. We could start rotating columns, so our editors have a longer time-period to complete their work (quantity- and quality-wise) in while another column fills up its spot in the newsletter, or we could change the number of times we release Default. The "rotate-thing" very heavily depends on other people submitting articles, so once again, when you feel that writing urge, don't hesitate, just do it :) Releasing Default on a different time-frame would be another solution, but we don't want to get the releases too far apart, we were thinking about once every 2 weeks or something. We're going to discuss this with all our editors as well, but we'd love to have some of your thoughts for them to think about then. Please give us some feedback on this. On a very different note, I would like to take this opportunity to congratulate our affiliates at Newstrolls (http://www.newstrolls.com) with their one year birthday. Keep up the good work! To finish off the points of interest, we now have 2 (or at least two of which we know of) mirrors up at Attrition.org (http://www.attrition.org/~modify/texts/zines/Default/) and NWO.net (http://www.nwo.net/Default). Well that's about it for me, nothing much more interesting to tell here. It's been a very challenging week, with some major security and privacy breaches discovered. We've tried to deal with at least a couple of them in this issue, untill then happy reading and thanks for supporting HNS and Default. For the HNS and HNS Default Crew: Berislav Kucan aka BHZ, webmaster Help Net Security bhz@net-security.org Xander Teunissen aka Thejian, co-webmaster Help Net Security thejian@net-security.org II. Last weeks news on Help Net Security ---------------------------------------- a) Help Net Security news headlines - Friday 27th August 1999: Microsoft Security Bulletin #31 Default #3 released Girl power hits e-commerce "Nines problem" Is Yahoo spam or anti-spam oriented? - Saturday 28th August 1999: Front page permissions New acquisitions in Linux world Debian not vulnerable 7 fired from first union bank - Monday 30th August 1999: Intel y2k ready Toadie Security hole in Hotmail - Tuesday 31st August 1999: Linus Torvalds More on Hotmail An overload of computer crime German encryption products freely exportable Pargain web hoax creator sentenced Canadian government site hacked CERT current activity How to counter an unseen, unpredictable enemy - Wednesday 1st of September 1999: Teen hacker arrested Legal percussions of the Hotmail flaw Adobe unveils secure pdf Microsoft issues IE patch Government preparing for y2k violence Office fix flawed WH panel calls for crypto export reform - Thursday 2nd of September 1999: Securitysearch Government sites attacked LOU dissolved "Thursday" virus sightings Most software sold online is pirated Hacker sentenced to 18 months The other y2k problem: Hacker attacks Hackers threat to minister's web site - Friday 3rd of September 1999: Visa and Cybersource target online fraud New privacy web service not so private Analyzer pleads innocent Projects page is up No y2k problems for cars Value net and scam The cleaner 3.0 Secure web based e-mail Windows contains a backdoor? - Saturday 4th of September 1999: Hackers answer MS Win2000 challenge PrivacyX reverses course City hires company for security audit Crackers threaten NASA and Mormon web sites Paris hacked b) Vulnerabilities reported in last week (our thanks goes out to BugTraq for this list) 27-08 Microsoft HTML Form Control DoS Vulnerability 27-08 ProFTPD Remote Buffer Overflow 30-08 Redhat amd Buffer Overflow Vulnerability 31-08 mars_nwe Buffer Overflow Vulnerabilities 31-08 TFS Gateway 4.0 Denial of Service Vulnerability 02-09 Netscape Communicator EMBED Buffer Overflow Vulnerability 02-09 Multiple Vendor INN inews Buffer Overflow Vulnerability 02-09 Cisco Catalyst 2900 VLAN Vulnerability c) Help Net Security site news * not applicable this week * d) Defaced pages: (mirrors provided by Attrition (http://www.attrition.org)) Site: Western Australian Electoral Commission (www.waec.wa.gov.au) Mirror: http://default.net-security.org/4/www.waec.wa.gov.au Site: Bureau of Transportation for Taipei City (www.dot.taipei.gov.tw) Mirror: http://default.net-security.org/4/www.dot.taipei.gov.tw Site: Ministry of Transportation and Communications, Republic of China (www.motc.gov.tw) Mirror: http://default.net-security.org/4/www.motc.gov.tw.htm Site: HotMail Hack (www.hotmailhack.com) Mirror: http://default.net-security.org/4/www.hotmailhack.com.htm Site: Ontario Ministry of Northern Development and Mines (www.mndm.gov.on.ca) Mirror: http://default.net-security.org/4/www.mndm.gov.on.ca.htm Site: 7th Army Training Command, Bavaria, Germany (www.cmtc.7atc.army.mil) Mirror: http://default.net-security.org/4/www.cmtc.7atc.army.mil.htm Site: MegaAdult (www.megaadult.com) Mirror: http://default.net-security.org/4/www.megaadult.com.htm Site: SecurityNet (www.securitynet.net) Mirror: http://default.net-security.org/4/www.securitynet.net.htm Site: Minist'rio da Agricultura e do Abastecimento (www.agricultura.gov.br) Mirror: http://default.net-security.org/4/www.agricultura.gov.br.htm III. Description of Y2K Problem ------------------------------- The Year 2000 problem (Y2K, Millennium Bug, Millennium Virus) came about due to programming practices involving the use of 6 digit dates (dd/mm/yy) vs. 8 digit dates (dd/mm/yyyy). This results in the possibility of a date such as 31 being misinterpreted (is it 1931 or 2031?). Thus, any computer program which deals with 6 digit dates is susceptible to the Y2K problem. The Y2K problem involves two key date issues: Date mathematics. For years businesses have used date math to compute things such as aging schedules, due dates, past due accounts, etc. Many computer applications now support the use of date mathematics (Lotus 1-2-3, MS-Excel, MS-Access, etc.) These applications all work by using a base year (often Jan. 01, 1900) as a starting point and then tracking the date and time numerically from that point (how much time has elapsed since Jan 01. 1900). Thus, a time might be stated as a fractional component of the day integer (35927.63 = May 12, 1998, 3:08 pm based on MS-Excel). This means that to compute the difference between Jan 01, 1998 and Jan 01, 1999 would result in 365 days. Computing the difference in today and when a bill was incurred would indicate how old a debt was (e. g. 45 days = past due). So, when the year 2000 comes into play using a 6 digit date we end up with situations like Jan 01, 00 - May 12, 1998. If this is misinterpreted by a computer system as 1900 then the calculation will result in a large negative number (in this case -35,926). This number may or may not be a problem the computer application can deal with. It is possible that this number will be made into the absolute value (the negative sign is dropped if no space is reserved to hold it) which will cause even more confusion. Imagine if your debt went from 22 days old to 35,926 days old. The past due notice would give you a surprise. In old COBOL (a programming language that is still in widespread use) dealing with date math is even more complicated. Dates in COBOL are typically stored in three different locations (a month, a day, and a year). The year is often stored as 2 digits to save space and simplify output problems with pre-printed forms. In some cases, COBOL programs were written with 4 digit dates and 1900 is subtracted from the date to generate the form (1981 - 1900 = 81) so that the form can look like 1981 when it is generated. This will cause a problem since 2001 - 1900 = 101 instead of 01. In other cases where a 6 digit date was used, the problem is even worse since there is no clear indication of which date we are talking with. Imagine COBOL program that deals with county records to record births and deaths. If all the dates are stored as 6 digits soon you will have records which say something like 09/03/63. Now suppose, I live to be a hundred years old, my birth is recorded as 09/03/63 and if I die on my birthday 100 years later my death would also be 09/03/63. A casual observer might interpret this as me dying at birth or who knows what. Thus, the main problem of Y2K is the problem of incorrect results when date mathematics are conducted. Most companies are working to correct these problems in their COBOL programs and most current microcomputer applications already have built in fixes. The second type of problem involves systems that check the date for some purpose to determine if a valid date is being used. An example might be a credit card expiration date. If the program that checks this when the card is scanned is very simple it might just say is today greater than the expiration date. Thus, 01/01/99 is greater than 01/01/00 which would result in your credit card being rejected. Another example is a security system which checks to see if today is a valid date before recording an entry or exit from a building. If the 00 date is determined to be out of range or the computation is at fault the system may simply shut down and lock all the doors. -------------------------------------------------------------------------------- Why did Programmers Do This? Essentially, several reasons exist for this problem: Saving Space in computer memory. Originally, computers had very small amounts of memory available and the repeated use of two extra numbers could make a significant difference on the amount of memory available so in the interests of efficiency, the seemingly redundant thousands and hundreds were dropped. Preprinted forms. Designing computer output for old systems was quite tedious and required that every variable be specifically defined. In order to make it easy to print a two digit year after a preprinted 19 it was simpler to use two digit years in the program. Unexpected Longevity. Since the year 2000 was a very distant date most people didn't really think about this problem until recently. Thus, a lot of programs were written in the traditional manner of using 2 digit years on the date. -------------------------------------------------------------------------------- What is COBOL and why does it exist? COBOL is a computer programming language developed by the CODASYL committee (Conference on Data Systems Languages) in 1959. COBOL became the business programming language of choice for large scale applications throughout the 60's 70's and 80's. Millions and millions of lines of COBOL programs were written and these systems (often called legacy systems) are still in use today since it is expensive and difficult to replace an accounting system or payroll system in a large corporation. The old adage, "If it ain't broke, don't fix it" has also played a roll in the continuation of COBOL as a programming language nearly 40 years after its original inception. Where is the problem? Any computer program which deals with dates is susceptible to this problem. Thus, if you use dates in any of your applications at home or work, you should make sure the applications you are using or the programs you are writing are compliant with 8 digit dates or have some other mechanism built in to deal with the year 2000. If you fail to do this your business may suddenly find all of its records our of order or important information could be lost due to problems dealing with data that is out of range. Will this problem dramatically affect my life? Not likely, most companies are taking steps to deal with this problem. There will likely be isolated incidences of problems (like a credit card rejected) that will quickly be identified and corrected by the institution. At home, if you make sure all of your applications and programs utilize 8 digit dates then you should experience no problems with your personal applications. What are Logic Devices [PLD]? Logic devices and programmable logic devices are technical terms used to refer to the many semiconducter based "chips" that are used to manage various devices (anything from a simple coffee maker to a giant production machine). These devices are usually programmed using Assembler programming language and it is estimated that literally 10s of billions of these things exist around the world. Why are people concerned about PLDs in conjunction with Y2K? Many people believe that a large number of devices that utilize PLDS will fail when the year 2000 rolls around since PLDS may contain date sensitive code. In particular programmable devices like VCRS, Coffee Makers, Security Systems, etc. are susceptable to this type of problem. If the PLD is date sensitive and was not set up to deal with 8 digit dates (discussed earlier), then a number of different things may happen, 1) the device may simply fail to operate; 2) the device may report the incorrect day of the week (if it thinks the year is 1900); 3) The device may fail to operate as expected (coffee maker doesn't come on in the morning). Thus, there is the potential for a lot of problems with this type of thing but I don't think any of it is earth shattering (although if my coffee maker stops working there is going to be a serious problem). The other side of this coin is that PLD devices are used in large production systems that manage things like power plants and food processing machinery (literally everything these days has a PLD in it somewhere). Many speculate that electricity will fail and all sorts of problems will ensue. My thought is that if the power company is not producing electricity then it is not making any money. While I have not worked in the power industry, my feeling is that they are testing these systems and making corrections so again, there may be some isolated power outages, but as soon as the power fails they can start repairing that system. What can I do about PLDs? Well, the easiest thing to do is to set the dates on the various devices in your house that are programmable (security system, coffee maker, etc.) to dates after the year 2000 and see what happens. If any problems ensue then you can figure out what to do next (contact the manufacturer or replace the device). Mostly I would check out your mission critical systems. I checked out the coffee maker and the security system and both worked fine. -------------------------------------------------------------------------------- How to be sure: Assess your personal work. Are there applications or programs that use dates in computation or for reference purposes? If you have such applications you may want to investigate to determine if those applications and programs use 6 or 8 digit dates. If you are using 6 digit dates, then you should convert them to 8 digit dates or at least test the application to determine if there is a problem (try entering some dates in the future). Be sure and back up your original files before you try any of this. Dr. Doug White Monfort College of Business The University of Northern Colorado doug.white@acm.org IV. A look into basic cryptography ---------------------------------- Last issue I gave you the algorithm to a message. The message was HELLO and encrypted, was CCJQA. I asked you to take the known key, 73, and decipher the message and release the way you decrypted it. Here is how you do it. A=1 B=2 C=3 D=4 E=5 F=6 G=7 H=8 I=9 J=10 K=11 L=12 M=13 N=14 O=15 P=16 Q=17 R=18 S=19 T=20 U=21 V=22 W=23 X=24 Y=25 Z=26 3-73=-70 26-70=-44 26-44=-18 26-18= 8 is the first letter. 8 is H 3-73-3=-73 26-73=-47 26-47=-21 26-21= 5 is the second letter. 5 is E 10-73-3=-66 26-66=-40 26-40=-14 26-14= 12 is the third letter. 12 is L 17-73-10=-66 26-66=-40 26-40=-14 26-14= 12 is the fourth letter. 12 is L 1-73-17=-89 26-89=-63 26-63=-37 26-37=-11 26-11= 15 is the fifth letter. 15 is O The original message is HELLO. Now mathematically... C(1)-N=X (if X<0, add it to 26. Repeat until 26>X>0. Thats the P(1). C(2)-N-C(1)=X (if X<0, add it to 26. Repeat until 26>X>0. Thats the P(2). C(r)-N-C(r-1)=X (if X<0, add it to 26. Repeat until 26>X>0. That is P(r). Now here's another challenge for you. The Ciphertext is XHGSQGAECWSI And no, I did not encode the key number. See if you can crack it. One suggestion is making a program to brute force it. Then again... It may be a very very very high number...but it also may be really small. I dont expect anyone to crack this. Ill release the message in the next issue. -you know the algorithm. Get to analyzing. NOTE: If anyone does come up with an algorithm, dont be shy. Send it on in, I will take a look at it. If I understand it and like something about it, I may just toss it up on here for people to look at. If I dont understand it, Ill inquire with you about it. Just dont send me a message enciphered with some algorithm you made up and ask me to crack it without the algorithm. Im balancing several jobs and doing this newsletter in my spare time, so I dont have much time to work on decrypting things. Thats it for today, you've seen the entire howto as it stands up to date. Expect more from me next issue. Been fun. -Iconoclast crypto@default.net-security.org V. Telecom 101 - Receiving through the serial port -------------------------------------------------- Hi and welcome to the last part of my pager-messages sniffing column. This one is going to be a quicky, but o well :). Anyways, let's get this going. As I earlier mentioned, it's possible to hook your scanner up to your pc and set it to scan certain frequency ranges for messages. In this way you could set it to receive pager signals which you could decode. Pagers however are made to pick up those signals for themselves and with a little modification even for others too. Today we'll put all of this together into a device to do some off-the-air POCSAG decoding. Using this device as a middle-man between your scanner/receiver and your box will allow a more accurate and clearer receipt of the POCSAG numeric and alpha-numeric signals. What will you need for this? The parts-list: U1 741 R1 100k R2 10k C1 0.1 uF C2-3 10uF, 16v D1-4 1N4148 or 1N914 Here's the schematic, yeah I know my ASCII skills are elite :) and the deciphering of this schematic will probably take up the most time, but this damn laptop keyboard of mine just isn't cooperating. D1-D4 -----------|>|------------------ DTR +12v | | |_ C1 2 |\ 7 |__|>|___ | __ | -----II---------------------| \| \|/ | | Audio In | 3 |U1\_6____ CTS | | | | ---| / | | | -- | | /| ---|>|----- | ----- | | | |/ 4 | | | |R1| -- -12v--------|>|---------- RTS | | | | | | --- -- |R2| --- --- | | | --- | C3 | -- | C2 ------------- | | | | GND ---------------------------------------------------------------- GND Now how to connect this thing. Input to this device comes straight from your receiver (pager/scanner) Most of the time you connect this device to the com2 port, but it more or less depends on what port you've got free. You connect the ports like this: COM Port 25 way 9 way CTS 5 8 GND 7 5 TxD 2 3 RTS 4 7 DTR 20 4 DSR 6 6 The device is powered by the serial port. Sources (go here for more info): An excellent article by Emanuel Goldstein in Phrack http://www.2600.com/phrack/p46-08.html Software for the actual encoding and decoding of POCSAG signals http://www.bearnet.demon.co.uk/pocsag/index.htm A pretty good (dutch) site on scanners and telecommunications in general http://ssb.auvicom.nl Ok that's it for today. Parting is sorrow, but don't worry, I'll be back in the next issue :) Xander Teunissen, aka Thejian, Help Net Security thejian@net-security.org VI. Security audit with our Mac ------------------------------- Part-1 Security audit are very fun, from penetration testing, to local domain(s) checking, to users rights it gives to white hackers a great way to express their skills. Common users thinks that it asks a very powerfull computer, it's not totally true unless you want to use bruteforce attack on ftp, webserver, appletalk, or nt passwords. There a 1000's of tools you can use: commercial products or freeware security tools. Yes you can use windows NT, linux tools but why not use all your favorites toys on one computer, a mac? Let's take a powerbook G3 450 mhz 128mo 6go to make this audit. The aim is to not make a C2 security level, even it can be done and checked from the powerbook, but a basic security audit focused on 3 points: -NT, Unix and AppleTalk Password ressistance to brute force attacks. -LAN production servers reliability. -DMZ penetration testing (from the internet and the local lan). First of all we will get a copy of two other OS: win NT and Linuxppc. Get something like virtualpc (http://www.connectix.com) or bluelabel (http://www.lismoresoft.com) to run NT and copy of Linuxppc (http://www.linuxppc.com). */First we will test the reliability of user's password.Almost 75 % of the threats comes from the inside of a company...Easy passwords and default rights (especialy with NT) on local network can be a VERY dangerous. For the brute force attack we will get dictionnaries (ftp://ftp.replay.com/pub/replay/wordlists/). Point your browser to L0pht to get the world most known NT password checker: L0phtcrack 2.5. For the appletalk password guessing we'll get Magic Key 2.0.2 (http://www.deepquest.pf/MK202.sit). You'll use L0phtCrack 2.5 on your virtualpc Workstation and Macgic key under MacOS. This first part doesn't ask much skills, but it will put heavy load on your computer, so let it run at least 1 business day to get a good result. If this network has Unix computers try to decrypt the password file locally or remotely with Meltino (http://www.deepquest.pf/mac.htm) it'll give you some passwords, more passwords you'll get less secure they are. It's very common to find names of people, animals etc... We could have used Linux for breakin the password file on the Unix computer, but Magic Key won't be able to run. Now you mac is in full effect: it's a real heavy brute force attack simulation: Appletalk, NT, and Unix password attack. Let your computer run several hours with this software, don't try to use anything else because of maximum cpu load and to get a better result. Make sure you merge several dictionnaries. */Major companies run win NT sever mixed with Unix flavored servers like Solaris. Plus those companies have most of time an Intranet, dialup access, and Internet webserver (sometimes directly hosted by an ISP). Your likely to find IIS or apache webserver. Those servers are for the different departements of the company (HR, Marketing, finance etc..) with restricted access.The best tool is to use a cgi-check program trying to access restricted directory, or administrativ files. The original cgi-check was written in C, so you have to compile it with Unix... There's another alternative, a few months ago I adapted this great tool to language more cross platform: rebol. You just have to get rebol from www.rebol.com and cgicheck 99. Then put the file on the rebol software or put cgi-check99.r in the rebol folder then launch rebol and do a "do %cgi-check99.r" it will ask you an ip to scan and will display the discovered vulnerabilities. Around 70 most known vulnerabilities are detected. Rebol runs on most OS'es. ----------beginning of code/c-p to a cgi-check99.r file---------- REBOL [ Title: "CGI Check 99 v0.3" Date: 9-Jun-1999 Author: "deepquest" Comment: "extR4 shOut 2: loser, packetstorm, attrition, H4k, acpo, krisTof, mad55, siRYus, bl4St, nucleus, & Other dark/white cR3Ws" File: %cgi-check99.r Email: deepquest@netscape.net Purpose: { Remote Exploits Checker 75 vulnerabilities. }] secure none print "CGI Scanner. Improved by deepquest." prin "Site to scan: " site: input a: exists? join http:// [ site "/cgi-bin/rwwwshell.pl " ] if a == yes [ print "THC - Backdoor" ] b: exists? join http:// [ site "/cgi-bin/phf " ] if b == yes [ print "PHF" ] c: exists? join http:// [ site "/cgi-bin/Count.cgi " ] if c == yes [ print "Count.cgi" ] d: exists? join http:// [ site "/cgi-bin/test.cgi " ] if d == yes [ print "test-cgi" ] e: exists? join http:// [ site "/cgi-bin/nph-test-cgi " ] if e == yes [ print "nhp-test-cgi " ] f: exists? join http:// [ site "/cgi-bin/nph-publish " ] if f == yes [ print "nph-publish" ] g: exists? join http:// [ site "/cgi-bin/php.cgi " ] if g == yes [ print "PHP" ] h: exists? join http:// [ site "/cgi-bin/handler " ] if h == yes [ print "handler" ] i: exists? join http:// [ site "/cgi-bin/webgais " ]if i == yes [ print "webgais" ] j: exists? join http:// [ site "/cgi-bin/websendmail " ] if j == yes [ print "websendmail" ] k: exists? join http:// [ site "/cgi-bin/webdist.cgi " ] if k == yes [ print "webdist.cgi" ] l: exists? join http:// [ site "/cgi-bin/faxsurvey " ] if l == yes [ print "faxsurvey" ] m: exists? join http:// [ site "/cgi-bin/htmlscript " ] if m == yes [ print "htmlscript" ] n: exists? join http:// [ site "/cgi-bin/pfdisplay.cgi" ] if n == yes [ print "pfdisplay" ] o: exists? join http:// [ site "/cgi-bin/perl.exe" ] if o == yes [ print "perl.exe" ] p: exists? join http:// [ site "/cgi-bin/wwwboard.pl" ] if p == yes [ print "wwwboard.pl" ] q: exists? join http:// [ site "/cgi-bin/www-sql " ] if q == yes [ print "www-sql" ] r: exists? join http:// [ site "/cgi-bin/view-source " ] if r == yes [ print "view-source" ] s: exists? join http:// [ site "/cgi-bin/campas " ] if s == yes [ print "campas" ] t: exists? join http:// [ site "/cgi-bin/aglimpse " ] if t == yes [ print "aglimpse" ] u: exists? join http:// [ site "/cgi-bin/glimpse " ] if u == yes [ print "glimpse" ] v: exists? join http:// [ site "/cgi-bin/man.sh " ] if v == yes [ print "man.sh" ] w: exists? join http:// [ site "/cgi-bin/AT-admin.cgi " ] if w == yes [ print "AT-admin.cgi" ] x: exists? join http:// [ site "/cgi-bin/filemail.pl " ] if x == yes [ print "filemail.pl" ] y: exists? join http:// [ site "/cgi-bin/maillist.pl " ] if y == yes [ print "maillist.pl" ] z: exists? join http:// [ site "/cgi-bin/jj " ] if z == yes [ print "jj" ] aa: exists? join http:// [ site "/cgi-bin/info2www " ] if aa == yes [ print "info2www" ] bb: exists? join http:// [ site "/cgi-bin/files.pl " ]if bb == yes [ print "files.pl" ] cc: exists? join http:// [ site "/cgi-bin/finger " ] if cc == yes [ print "finger" ] dd: exists? join http:// [ site "/cgi-bin/bnbform.cgi " ] if dd == yes [ print "bnbform.cgi" ] ee: exists? join http:// [ site "/cgi-bin/survey.cgi " ] if ee == yes [ print "survey.cgi" ] ff: exists? join http:// [ site "/cgi-bin/AnyForm2 " ] if ff == yes [ print "AnyForm2" ] gg: exists? join http:// [ site "/cgi-bin/textcounter.pl " ] if gg == yes [ print "textcounter.pl" ] hh: exists? join http:// [ site "/cgi-bin/classifieds.cgi " ] if hh == yes [ print "classifieds.cgi" ] ii: exists? join http:// [ site "/cgi-bin/environ.cgi " ] if ii == yes [ print "environ.cgi" ] jj: exists? join http:// [ site "/cgi-bin/wrap " ] if jj == yes [ print "wrap" ] kk: exists? join http:// [ site "/cgi-bin/cgiwrap " ] if kk == yes [ print "cgiwrap" ] ll: exists? join http:// [ site "/cgi-bin/guestbook.cgi " ] if ll == yes [ print "guestbook.cgi" ] mm: exists? join http:// [ site "/cgi-bin/edit.pl " ] if mm == yes [ print "edit.pl" ] nn: exists? join http:// [ site "/cgi-bin/perlshop.cgi " ] if nn == yes [ print "perlshop.cgi" ] oo: exists? join http:// [ site "/_vti_inf.html " ] if oo == yes [ print "_vti_inf.html" ] pp: exists? join http:// [ site "/_vti_pvt/service.pwd " ] if pp == yes [ print "service.pwd" ] qq: exists? join http:// [ site "/_vti_pvt/users.pwd " ] if qq == yes [ print "users.pwd" ] rr: exists? join http:// [ site "/_vti_pvt/authors.pwd" ] if rr == yes [ print "authors.pwd" ] ss: exists? join http:// [ site "/_vti_pvt/administrators.pwd " ] if ss == yes [ print "administrators.pwd" ] tt: exists? join http:// [ site "/_vti_pvt/shtml.dll " ] if tt == yes [ print "shtml.dll" ] uu: exists? join http:// [ site "/_vti_pvt/shtml.exe " ] if uu == yes [ print "shtml.exe" ] vv: exists? join http:// [ site "/cgi-dos/args.bat " ] if vv == yes [ print "args.bat" ] ww: exists? join http:// [ site "/cgi-win/uploader.exe " ] if ww == yes [ print "uploader.exe" ] xx: exists? join http:// [ site "/cgi-bin/rguest.exe " ]if xx == yes [ print "rguest.exe" ] yy: exists? join http:// [ site "/cgi-bin/wguest.exe " ] if yy == yes [ print "wguest.exe" ] zz: exists? join http:// [ site "/scripts/issadmin/bdir.htr " ] if zz == yes [ print "BDir - Samples" ] aaa: exists? join http:// [ site "/scripts/CGImail.exe " ] if aaa == yes [ print "CGImail.exe" ] bbb: exists? join http:// [ site "/scripts/tools/newdsn.exe " ] if bbb == yes [ print "newdsn.exe" ] ccc: exists? join http:// [ site "/scripts/fpcount.exe " ] if ccc == yes [ print "fpcount.exe" ] ddd: exists? join http:// [ site "/cfdocs/expelval/openfile.cfm " ] if ddd == yes [ print "openfile.cfm" ] eee: exists? join http:// [ site "/cfdocs/expelval/exprcalc.cfm " ] if eee == yes [ print "exprcalc.cfm" ] fff: exists? join http:// [ site "/cfdocs/expelval/displayopenedfile.cfm " ] if fff == yes [ print "displayopenedfile.cfm" ] ggg: exists? join http:// [ site "/cfdocs/expelval/sendmail.cfm " ] if ggg == yes [ print "sendmail.cfm" ] hhh: exists? join http:// [ site "/iissamples/exair/howitworks/codebrws.asp " ] if hhh == yes [ print "codebrws.asp" ] iii: exists? join http:// [ site "/iissamples/sdk/asp/docs/codebrws.asp " ] if iii == yes [ print "codebrws.asp" ] jjj: exists? join http:// [ site "/msads/Samples/SELECTOR/showcode.asp " ] if jjj == yes [ print "showcode.asp" ] kkk: exists? join http:// [ site "/search97.vts " ]if kkk == yes [ print "search97.vts" ] lll: exists? join http:// [ site "/carbo.dll " ] if lll == yes [ print "carbo.dll" ] mmm: exists? join http:// [ site "/cgi-bin/whois_raw.cgi?fqdn=%0Acat%20/etc/passwd " ]if mmm == yes [ print "whois_raw.cgi" ] nnn: exists? join http:// [ site "/doc " ]if nnn == yes [ print "Debian Boa" ] ooo: exists? join http:// [ site "/.html/............./config.sys " ]if ooo == yes [ print "ICQ99" ] ppp: exists? join http:// [ site "/....../ " ]if ppp == yes [ print "personal webserver" ] rrr: exists? join http:// [ site "/scripts/no-such-file.pl " ]if rrr == yes [ print "IIS-perl" ] sss: exists? join http:// [ site "cgi-bin/visadmin.exe?user=guest " ]if sss == yes [ print "OmniHTTPd Web Server " ] --------------------end of code-------------------- Another basic thing you can do if to look for latest security issues from forums like Bugtraq or others. Zero day exploits have to be taken in consideration since you're asked to take a snapshot of Information Services. Don't waste your time on local bugs, but rather on remote exploits. I assume the company has at least a secure data room! Another thing to do from your virtualpc is to use a dumpacl and dumpreg for NT server. What are the access levels and for who? Checkin Appleshareip shares is a very fast to check remotely with ServerScan (http://freaky.staticusers.net/network.shtml). You won't have to worry about special shares like NT does in registry, or admin share c$ etc... Unix is quite different I suggest you to use Panda309 by thegrid (http://www.deepquest.pf/panda309-v1.0.tar.gz).It runs on Linuxppc, does a B or C class portscan with remote OS fingerprinting and some vulnerability detections. In few minutes you get a topo of the LAN. This part of the audit can take up pretty much time, but make sure you check what you're told to check :-) /*EOF 1-2 ps:this txt does NOT make your computer, LAN, DMZ safer at all!It's just a basic overview of what you can do from a mac. DMZ audit to be continued....next week Deepquest deepquest@default.net-security.org All rights not reserved- Serving since 1994 http://www.deepquest.pf VII. Computing: Matrox G400 MAX Review -------------------------------------- Matrox has been around since the dawn of 3D graphics. Their Millenium actually harbored a 'few' 3D features but the subsequent Mystique, PowerVR PCX2 and G200 parts were far from being 'real' gaming boards. The performance and feature list was way below par for the Mystique and the G200 just couldn't cope with Quake 2. 1997 to the present hasn't been exactly fruitful for Matrox. Gamers in particular have always sided with 3dfx or NVIDIA. With only a few OEM design wins for the G200, Matrox clearly had some work to do for their next generation G400 chipset. The fill rate of the G400 MAX is certainly up there with the best of the bunch at 333MTexels per second (and identical to that of the Voodoo3 3000). The G400 MAX processor also supports single cycle multi-texturing (great for those 3D first person shooters). As with most of these new 2D/3D chips, the G400 MAX is on a .25micron five layer metal process technology. It also harbors Matrox's 256-bit DualBus architecture with true 128-bit external bus to video memory. Although we've yet to witness the Camino and APG 4X, the G400MAX is AGP 2X/4X capable with Multi-threaded Bus Mastering. It's ably backed up by 32MB of SGRAM. Matrox hasn't actually come out and said what their clock speed is but with a 333Mtexel/sec fill rate, it's pretty easy to work out that 'magic' number. Bearing in mind that it is two cycles per clock you simply divide 333 by two and are left with 166MHz. D3D is certainly where the 'future' lies and with a G400 MAX and its 32MB, you'll be in the very best of hands. It really is exceptionally fast. The Forsaken scores were not only the fastest yet seen.but the astounding 32-bit performance certainly sets a precedent. The performance hit was minimal at 'worst' and at 800x600 in 32bit, frame rate was over 200fps. Even at 1600x1200 we still see scores over 70fps in 32-bit on a Pentium III 500MHz. The multitexturing capabilities of the card under DX6 were also impressive as the Shogo: MAD scores show. (The higher the resolution and color depth, the wider the gap between the G400MAX and the rest.) No FINAL ICD was available with the review unit. Matrox really does need to sort this out in time for the product launch (it even says a FULL ICD is supposed to come with the retail part). Clearly some work needs to be done. Quake 2 performance, whilst acceptable (especially at the higher resolutions), was still some way off from a Voodoo3 or TNT2. Half-Life was even worse. The performance was way below par. We understand that the OpenGL drivers we were given were in BETA so we'll update these scores as and when we can. On the other hand, Quake 3: Arena at 1024x768 and in 32-bit was very playable. (The slower OpenGL Quake 2 scores force us to dock a point off of the final score. Should Matrox get around to improving the performance- we will re-evaluate.) Clearly for its whopping great $249 asking price, this card is NOT for the low-end user. The faster your CPU, the better performance you get for your money. A Celeron 400 would be our cut-off point, where you're still likely to find that the D3D performance is top notch. (The question is, how many game developers are going to implement this feature. We hope it picks up more than S3's S3TC has done thus far. Matrox lists some 40 games.....) Ok so now you've seen just how stunning a game can look when the feature is implemented but what's the big deal? All the major 3D chip manufacturers list 'bump mapping' on their spec sheet, right? Well the truth is out there somewhere. There are many ways to represent this effect. There's the conventional cheat of embossing, there's the PowerVR way, there's the Dot3 3Dlabs method and finally there's the Matrox way. Matrox's implementation of this DirectX6.0 'quality feature' allows for a richer looking environment than mere embossing can simulate. It allows for multiple light sources in one pass as well as reflective environment mapping on the same bump. Most other 3D cards (the Voodoo3, TNT2 etc.) use the conventional embossing method to simulate bump mapping- which really isn't all that big of a deal. Voodoo Graphics could do the very same thing way back in 1997. This Embossing (or multi-pass alpha blending) is limited to monochrome lighting and also brings out artifacts when simulated because of its per-polygon technique (Matrox's bump mapping is per pixel instead). Using embossing won't give you those luscious rolling waves as seen above, one can't use an environment map to simulate distortion effects. Basically, a TNT2 or Voodoo3 will 'counterfeit' bump mapping because embossing is NOT the real deal. In a market so over-saturated it's really no surprise that Matrox is pushing their beloved bump mapping so hard. For them it's what separates their card from the rest of the crop. The question is, does it do for you what it does for them? You've seen the shots of Expendable but even if Matrox convinces game developers that bump mapping is a case of 'do or die', it'll still be a while before it becomes an industry standard (if it indeed does). The jury is still out amongst gamers and game developers alike in terms of the performance hit entailed with bump mapping. Although Expendable 'seemed' to hold-up to a similar frame rate when bump mapping was turned on, it wasn't really the best test. Odd cars and water effects are not exactly 'whole scenes'. Try a couple of Quake 3: Arena 'bump mapped' tunnels and then we'll know for sure. Having said that, using embossing is an even greater strain on your CPU as it calculates UV shifts. (It really is gorgeous but will game developers support this feature? Only time will tell.) The G400MAX is certainly a 'feature' driven product. Just like the NVIDIA TNT2, it harbors support for 24-bit Z-Buffer with an 8-bit stencil buffer (which looks excellent when used in Quake 3). The stencil buffering can be used to specify conditional masks, which in turn allows for dissolve and transition effects such as volumetric shadows, silhouettes, scorch/skid marks etc. It's certainly a welcome feature and eradicates the 'flickering shadow' seen with a 16-bit Z Buffer. (Whilst far from being an essential feature (the Voodoo3 is limited to a 16-bit Z buffer) it does add to the overall LOD of a complex scene. Most other chips support this now.) The G400MAX's DualHead Display is certainly one of its most interesting and innovative characteristics. In a market saturated by products that all do the same thing, the DualHead Display technology gives end-users something else to think about. In a nutt-shell, it allows a single chip to output two physically separate images simultaneously to two different output devices. This feature currently supports simultaneous output to either two RGB monitors, to an RGB monitor and a television set, to an RGB monitor and a Digital Flat Panel or to two analog Flat Panels. The G400 design contains two separate Cathode Ray Tube Controllers (CRTCs), which can retrieve data independently from different locations in the AGP memory or display buffer. Interestingly enough, the two CRTCs (connected to the integrated 360 MHz RAMDAC) can read the same image but at varying refresh rates. The second CRTC can be connected to the TV-Out function (which supports PAL/NTSC and SECAM) or to a DFP (Digital Flat Panel Display) transmitter, with an RGB stream of up to 1280x1024 at 32 bit (in 60Hz for a second monitor). The DualHead also solves the 'flicker' problem and eliminates limitation of current TV-Out solutions, where the PC monitor has to run at 50/60Hz in order to support the PAL/NTSC TV-Out standards. "So what", you might think? Have you ever tried editing images in Adobe Photoshop? With the DualHead feature enabled, you could have all your small images on one monitor and edit a blown-up version of an image on another. One monitor can be used to display the canvas, whilst the toolbars can be displayed by the secondary monitor. Photographs and scanned images can be zoomed, whilst pixels can be zoomed to the second display for retouching. Less, minimizing and all around less hassle- we've tried it and really can see the benefits for the artistically minded end-user. Photoshop isn't the only application suited for this feature either. Gamers might also be able to reap the benefits too in the not too distant future. Flight Sim fans would surely crave for multimonitor in-game support. Fire a missile and then track its progress on the second monitor. well we're still some way off from seeing that but Microsoft has already stated that their MS Flight Simulator series will harbor support for DualHead. Windows 2000 will also mean this feature might well get used more and more. There are other advantages to this DualHead technology (see below). For example you can watch a DVD movie on one screen whilst whizzing through your spread sheets (what joy) on another. (Matrox has clearly decided to stay 'ahead' of the game and gone for innovation. DualHead won't change your life just yet but its usefulness should grow.) The Matrox G400 doubles the engine bandwidth by using 256-bit DualBus architecture, composed of two independent one way 128-bit buses working in parallel inside the chip to output 128 bits of valid data on every chip clock cycle, while the traditional 128-bit bus outputs 128 bits of valid data only on every other clock cycle. Here's how it works. The two internal buffers store a multitude of instructions and/or data. On every chip clock cycle, data is sent to the engine via the 128-bit internal input bus and on the same chip clock cycle, processed data from the engine is sent back to the output buffer via the 128-bit internal out-put bus. It's a two-lane highway compared to a one-lane bridge. Because the external 128-bit bus to video memory can run at higher clock rates than the internal graphics engine, data multiplexing logic is used to manage the data buffers to ensure that data is being sent to the engine, and that processed data is being read from the engine, on every chip clock cycle. This way, the bus never sleeps. With the advent of multi-textured applications comes the potential for multiple messes. While single texturing is relatively straight forward, multi-texturing requires blending many textures onto a single polygon. If your hardware does a sloppy job of it you end up with UGLY. The key is precision throughout the internal 3D pipeline. In the ongoing 16 vs. 32-bit debate, don't lose sight of the reason it makes a difference: More bits means more accuracy. The reason 3dfx can claim closer to 22-bit color is because their internal pipeline is 32-bit. Well, Matrox has gone a step further and outputs at 32-bit as well. In fact they've gone a 32-bit mad, here's the list: o 32-bit precision throughout the 3D pipeline along with 32-bit accumulation buffers o 32-bit rendering to ensure all internal operations are done with 32-bit accuracy o 32-bit source textures (with support for texture sizes up to 2048 x 2048) o 32-bit Z-buffer/stencil buffer for maximum depth precision o 32-bit internal results dithered down for the highest quality 16-bit output Lest you get the notion that 32-bit is the only buzzword on their lips, here's another list: o Full subpixel and subtexel positioning o 8-bit filter coefficients, to provide the best quality bilinear, trilinear and anisotropic filtering o Ultrasharp RAMDAC technology for fully saturated analog outputs. Here is Matrox's reasoning "A 32-bit texture typically has eight bits for each of the following components: Red, Green, Blue, and Alpha. Therefore, 32-bit rendering selects from among 256 different shades of each RGB color component, for a total of 16.7 million possible colors. On the other hand, a 16-bit texture typically has five bits for each Red, Green and Blue component, and only one for Alpha. This means that 16-bit rendering draws images from a color palette containing 32 shades for each color component, for a total of only 65,000 possible colors. 32-bpp color accuracy throughout the rendering pipeline makes for a cleaner, smoother gradient of colors than 16-bpp can deliver. The reason for the difference in quality is simple: the lack of available shades with 16-bit rendering results in lower image quality. On top of this, internal calculations with 16-bit rendering deteriorate image quality even further due to the errors caused by lack of precision." Didn't we just say that? Unlike everything Voodoo which utilizes AGP for the bus speed only, the Matrox G400 and G400 MAX are designed from the inside out to make maximum use of the AGP 4X's 1GB/sec bandwidth. While that doesn't much matter now (there is narry a 4X equipped system to be had) it could matter a great deal when Intel and AMD release their full AGP 4X rigs and developers really begin to push that envelope. The Matrox G400 chipset entails an MPEG II DVD decoder (most next generation 2D/3D cards do these days). The software bundle that Matrox has gone for is Zoran's SoftDVD2 (ATI uses the same) player for DVD video playback, which lets you watch all of your favorite flicks on your PC. The software itself is easy to use and get used to with the remote control supporting basic play functions, as well as advanced navigational features (play, forward, rewind etc.). The usual array of features include, sub-picture blending, aspect ratio scaling (allowing for 16:9 encoded DVD on to 4:3 aspect ratio TVs) and full-screen output to a TV. The default resolution for watching movies is at 800x600 (the software automatically drops your desktop to this resolution). Although Zoran's SoftDVD software is well respected and a popular choice, the first version was also known for its 100% CPU usage. As with the previous version of Zoran's SoftDVD, this new version also requires a hefty CPU- a Pentium II 333MHz being the MINUMUM spec. The software decoding hogged most of your system's resources so checking stock prices whilst watching Mr. White go bezerk in Resevoir Dogs wasn't really an option. Version 2 of the SoftDVD has been markedly improved in terms of its CPU usage and multitasking (whilst not advised) is just about possible. For much more rewarding results, the G400MAX's DualHead function can be used to great effect. For example, you could use the primary RGB output for your web browsing, whilst at the same time use the second RGB output to watch a DVD movie on a second monitor. Then again, you could do your work faster, unbothered by a movie in the background and then just switch off your PC and go watch a movie on your TV later... Features o Title and menu options include title and chapter search, subtitle and language option, audio and root menu o Language selection of up to 32 different audio tracks o Seamless viewing angle switching without audio interruption o Parental lock for controlling adult content (The quality of the MGA-G400MAX really does the DVD job well. The pictures are crisp and the colors rich (useful during the full 1hour 33mins of the Resevoir Dogs test)) The 2D on the Matrox is absolutely unbeatable. You couldn't really expect anything less from Matrox, who have been the 2D kings on and off since the Millenium days. The G400 MAX's 360MHz RAMDAC is the fastest to date (some 10MHz faster than on a Voodoo3 3500) and as a result has the best 2D performance so far. The G400 MAX's UltraSharp DAC technology and support for true 24-bit color at resolutions as high as 2048 x 1536 dishes out fast screen refresh rates along with crisp/clean text and images. The 256-bit DualBus graphics engine and optimized AGP 2X chip design no doubt helped it fly through a couple of ZD 2Dwinbench runs. (If 2D is your oyster then the two best 2D performers are the G400 MAX and the Voodoo3 3000 (in that order).) Matrox's PowerDesk tools have always been solid and in the G400 MAX's case, it's no different. You can tweak away till your heart's content (refresh rates, gamma settings). The controls for the DualHead are also easy to use and just require 'checking' and 'unchecking' as the case may be. Gamers will be slightly 'peeved' at the lack of a V-Sync 'disable' check box. Those of you that are happy to edit the registry can do just that, whilst others may choose to use Powerstrip etc... Matrox chose to stay WHQL certified and thus offers no V-Sync disabling functions. (No witnessed ZERO crashes in any Windows applications.) Other than the provided DVD software from Zoran (top notch) and the Matrox drivers, nothing has yet been set in stone. All of the bump mapping demos found on their web site came with the CD as well as playable demo versions of Expendable, Drakan and Slave Zero. All fun while they lasted. Matrox has entered the 3D gaming scene. The G400MAX is lighting quick in some D3D games but when multitexturing comes into play, the architecture doesn't seem quite as efficient as the Voodoo3's or TNT2's and the OpenGL really needs improving. So really hardcore gamers that live and die by Quake 2 (let's see how Quake 3 performs when the timedemo is released) might still want to go for a Voodoo3 3000 or a UltraTNT2. If you're a gamer but all about 'image' rather than frame rate, the G400MAX wins hands down. It did outperform a Voodoo3 and UltraTNT2 in some D3D tests and it also shows that 32-bit rendering can be used at a minimal performance loss. Alongside the UltraTNT2, the G400MAX harbors the best image quality and with bump mapping enabled (where possible) it creeps ahead. Whilst on the expensive side at $249.99, we were still left pleasantly surprised and do recommend this card to gamers and end-users who would make use of some of the more innovative features such as DualHead. GOOD: o Visual Quality o Unique Features (bump mapping & DualHead) o Exceptional D3D performance BED: o Quake 2 Scores not up to scratch (currently) o High Price o Requires a fast CPU Damir Kvajo aka Atlienz atlienz@default.net-security.org VIII. Understanding basic crypto techniques ------------------------------------------- To begin with, it's important to understand the primary basic techniques of encryption: symmetric key-based algorithms, such as block ciphers and stream ciphers; asymmetric key-based algorithms, such as public key encryption; and hash ciphers, which are used for passwords on most operating systems. These are the three primary methods of cryptography systems -- most systems are based on one of these techniques, or a combination of them. Block ciphers and stream ciphers are known as symmetric key-based algorithms. What this means, in plain English, is that the same key is used for encryption and decryption. If I encrypt the word 'SPEEDBOAT' as 'QLXXAFRMP', such that Q=S, L=P, X=E, etc, then I should be able to decrypt 'QLXXAFRMP' using the same key. Block ciphers are commonly used to encrypt files on a system. In a block cipher, information is divided into equal-sized blocks of text (say, five letters: 'THIS IS A SECRET MESSAGE' would be separated into 'THISI SASEC RETME SSAGE') and then each block is encypted using the same algorithm. IDEA is an example of a well-known block cipher, as is Blowfish. In stream ciphers, data is encrypted in much smaller chunks, usually bits. This form of encryption is generally what's used to encrypt information as it passes from one system to another, because it's much faster than block ciphers -- crypt (the original UNIX command) is a stream cipher, as are most non-computer based encryption systems. For instance, the Cryptoquote in many daily newspapers is a stream cipher -- each letter is encrypted as it comes. The differences between the two are mostly in the implementation. An easy way to think of it is that block ciphers are generally implemented within software, while stream ciphers within the hardware encrypt individual bits as they go by. In asymmetric key-based algorithms, a different key from the one used to encrypt a message is used to decrypt it. This is more commonly known as public key encryption, and RSA is a notable implementation of it -- a user of public key encryption has both a public key (which is used to encrypt a message) and a private key (which is used to decrypt a message). In a public key system, I could post my public key somewhere easily available, and a complete stranger could use it to encrypt a message. He then sends the message to me, and my private key decrypts it. If the message is intercepted, because two different keys are used, my message remains secure even if the interceptor has my public key. Only the private key can decipher the encrypted message. And then there are one-way hash systems, such as SHA and MD5, which most operating systems use to store passwords. I discuss password management in detail later in the article. Some encryption implementations use all three methods to serve various different purposes in the system. For instance, the well-known public key system PGP (Pretty Good Privacy) uses the IDEA block cipher for the actual encryption of the data, RSA for the public and private keys themselves, and an MD5 one-way hash for passwords. This way, the system itself is protected in many ways, with each cryptography technique being put to its best use. How passwords work ------------------ Most operating systems handle passwords by using one-way hashes. What this means, in practice, is that your password is not stored anywhere on your computer. When you initially enter your password, the system encrypts it using a hash function. The system knows how it hashed the sequence of characters that is your password, so every time you log on, the system encrypts what you have just typed using the same hash function, and compares the encrypted results to the encrypted password. For instance, if your password is 'Superman', the actual hash may look something like 'dLboH6tH$kP/Nre1TMLr4thuBRmz' (please note: this is not an actual hash). Whenever you type in the word 'Superman' at your password prompt, the machine sees 'dLboH6tH$kP/Nre1TMLr4thuBRmz'. It compares, notes that the two hashes are the same, and lets you into your account. What password cracking programs do is either take lists of words (in the case of a dictionary or word file attack) or generate strings of characters (in the case of a brute force attack), encrypts them, and compares them to the hashes in the password file until it finds a match. This is why it's important to protect your password file even though it's encrypted. References ---------- By far the most comprehensive book on cryptography is Bruce Schneier's _Applied_Cryptography_ (2nd edition). It's easy to understand, so if this subject interests you, I recommend buying it. For information about breaking password encryption, L0pht's documentation for L0phtCrack (http://www.l0pht.com/l0phtcrack/) contains a brief description of the various methods it uses. Crack (http://www.users.dircon.co.uk/~crypto/) is a dictionary-style password checker, and John the Ripper (http://www.false.com/security/john/) is a brute force-style password checker. /dev/null null@fiend.enoch.org IX. Infection & Vaccination --------------------------- It's been a long time but yes we do have two spanking new trojans for you. We also have a little story for you. To top that off we continued with our general trojan info: why trojans work on Windows 95 and not Windows NT. Our first trojan of the week is called Digital Rootbeer. The name is the most unique thing about this trojan. It has a lot of features, but nothing new. The most dangerous feature is it's file control(Execute, upload, download, delete). Rootbeer listens for connections on port 2600 (TCP) and cannot be changed. It installs to c:\windows\ with whatever name it is called when you run it. It does not run on Windows NT. If you would like to find out where the original file is open regedit and browse to: HKEY_LOCAL_MACHINE\SOFTWARE\1999 --=[">?t~%?"-MÑN]=--\. The Program Path key contains the location and filename of the file you ran that installed Digital RootBeer. So you might be able to find out who gave it to you. Like if someone on ICQ gave it to you, it should be in the received files under the name of the person who sent it to you. Here is the 3 step manual removal 1. Open regedit and browse to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\. Then remove the ActiveX Console. 2. Close the server or reboot the machine. 3. Browse to c:\windows and remove the trojan file which can be found in the Program Path key at HKEY_LOCAL_MACHINE\SOFTWARE\1999 --=[">?t~%?"-MÑN]=--\. The next trojan we have for you is Death version 1.0 by Earlz Plumbing. The client's GUI looks nice but is rather difficult to use. It too has a lot of features like Digital Root Beer without anything new. Though it does have a window lock command to lock a window on the host computer from being updated. While unlike RootBeer it runs on port 2 TCP, which can be changed. Unfortunately we could not get it to run on Windows 95 because it needs Visual Basic 6 runtime files which we currently do not have on that machine. On our NT machine we do have VB 6 files, but it does not infect NT :-) Sorry. Here is a little story that has many good lessons to learn from it. One of our friends came across this page: http://www.blue.icestorm.net/nerv/. It has a program called iCMP J1zz that can knock anyone off of IRC. Which is a tool we all need isn't it. Well even though the person took credit for programming it in C++, it is in fact a SubSeven server configured. I could be wrong but it appears the j1zz.exe has some Visual Basic runtimes files in plain text when viewing in notepad, which is usually an indication its programmed in Visual Basic. Another thing I do not believe that SubSeven is even made in C++ so that's just wrong. Believe it or not we actually have some lessons that can be learned from this. Okay well first don't just go downloading every cool sounding program you see. Another thing is if your infected with a trojan you can always send it to me to be studied. I had fun finding an Email address and 2 different ICQ UINs from the SubSeven server. To all you people that use trojans, maybe you should not use SubSeven. Also just for your info on that site all 3 programs are just SubSeven servers. Okay here is our last section for this week. It's a simple thing that a lot of people don't realize. Most trojans will not run on Windows NT due to two. First there is no c:\windows directory standard on Windows NT which messes up a very small number of trojans. The other difference between Windows NT and 95 is in the API code. When a trojan tries to hide from the taskmanager you can view on Windows 95 (Using Alt-Ctrl-Del) it uses an API code which differs enough on NT to stop it from working. Next week we will compare the following Trojan removers: Trojan Defense Suite, LockDown 2000 and The Cleaner. Hope you all have a trojan free week. Zemac zemac@dark-e.com http://www.dark-e.com X. New programs on Net-Security (NS Watch!) ------------------------------------------- After some time, Projects page on net-security.org is finally updated.This page will follow its previous tradition in bringing you the best security programs made by net-security staff. NS Watch! (NSW) in its latest version (2.0.4.0 FINAL) is a program that watches over your windows\system, registry run keys and 32 bit CRC of selected files. I have come to idea to make this program after I was hit by Marburg virus. Idea was to make something like logger that would take care about newcomers in your windows\system and registry run keys.I was not satisfied with loggers like regmon and filemon because they were displaying to much unimportant info. After first version released I found one symapthic CRC calculating rutine. Why not to include it in NSW?So I did it and that was it.Of course they were some bug occuring, and I encourage you to uninstall any previous NSW version except this FINAL. Second program is made by one person that is not in net-security.His name is Dancho and he made Trojan Library.It is one of the few programs of its kind, because it is bringing you latest Trojan/Worm information for reading offline.Dancho promised that he will update this library often so don't forget to check projects page from time to time. I will put some "Goltha approved" :) links also on projects page.I know we have already links page on net-security, but this links are going to lead only to sites very you can find very useful or rare things. And in the end, if you have any comments, wishes or anything else do not hesitate to contact me... Tomislav "Goltha" Petrovic Net-Security programer goltha@net-security.org XI. More news from the ACPO front --------------------------------- Hi again... I'm honored to be allowed to tell you a bit more about ACPO [http://www.antichildporn.org] and our future... This weekend, we will be traveling to deliver a presentation to our first political group, http://WWW.mntaxpayers.org/#Moorhead Conference. I'll fill you in on more of the details next week. BTW .. just a little note here about politics, we do not support any political group, just the stopping of child abuse and child porn on the internet.. Some people are concerned with our involvement in governments and their politics. But please tell me a way to stop this injustice without involving ourselves in politics and the law! We are just beginning to plan our first European tour--roughly in the October/November time frame. While we know the places we must visit, we are open to your suggestions, as to places we might have an opportunity to tell our story, and recruit Euro. members. Please eMail me at natasha@infovlad.net if you have suggestions or ideas. On the home front, ACPO will be attending the Techno-Security & Disaster Prevention '99 Conference. http://www.thetrainingco.com/Agenda-99.html Plans are being made to develop additional approaches in assisting law enforcement to identify and successfully prosecute child pornographers. We anticipate forming both public and private partnerships to further this cause. Thanks again to net-security.org for their support, and this forum to express ourselves, and to keep you informed. Natasha Grigori Founder antichildporn.org ============================ Thanks for being 'Child-Friendly' Natasha Grigori Founder AntiChildPornOrg ACPO http://www.antichildporn.org/ mailto:thenatasha@mediaone.net ============================ XII. The Hotmail security hole ------------------------------ Hotmail, one of the best known Microsoft acquisitions, was included in a security scandal earlier this week. Group of "hackers" (I will talk about this later), discovered a backdoor in Hotmail service, which opens millions of accounts to other people. "We did not do this hack to destroy, we want to show the world how bad the security on Microsoft really is, and that company nearly have monopoly on [all] the computer software" - Lasse Jung aka DarkWing said to the media (this group talked with Swedish tabloid Expressen and one of the big media houses online - Wired News (www.wired.com). It looks like they found a hole in new Microsoft Passport program that is a secure (lol:) way for you to sign in to multiple Internet sites using one member name and password. ---------------------------------------------------------------------- Here's how it works: If you sign in to Hotmail or any other MSN site, you are automatically signed in to all MSN sites that use Passport. As you move from site to site, you'll instantly be recognized, and you'll have access to the best features the sites have to offer. Once other Internet sites begin using Passport, you'll also be able to sign in to those sites with just one click-without having to re-enter any information. No multiple sign ins, no hassles! ---------------------------------------------------------------------- Ok so it looks good, but security is a myth. It would be better to MSN members spend 10 seconds more for entering their password again, than the computer caches logins and passwords. The main problem was that Hackers Unite found an address which opens any Hotmail mailbox with using password "eh". It was the following address: http://207.82.250.251/cgi-bin/start?curmbox=ACTIVE&js=no&login=username &passwd=eh It could be used from a mailform or just copy-pasting the URL into your browser. You could look at the image of the "hotmail-hack" mirrors: http://default.net-security.org/4/hotmail.jpg Microsoft's response: ---------------------------------------------------------------------- Dear Valued Customer, You may be aware from published reports that recently MSN Hotmail experienced service issues that have generated questions about security. We can tell you that the issue has been resolved and MSN Hotmail is currently operating normally. This letter is intended to address your concerns and provide you with the latest information concerning this issue. Microsoft was notified early Monday morning (August 30, 1999) of a potential security vulnerability that could enable unauthorized access to Hotmail servers. Microsoft immediately began to investigate the issue and in the interest of user privacy and security made the decision to temporarily take Hotmail servers offline. In light of the inconvenience that such an action can cause users, this is not something that we take lightly but felt that, given Microsoft's commitment to protecting people's private data and information, it was an appropriate course of action. Since then, Microsoft engineers have worked quickly to pinpoint the issue and to resolve it and have restored the Hotmail servers so that users can continue enjoying the benefits of Hotmail with full privacy and security. Please note that no action on your part is necessary to take advantage of the updated Hotmail. We apologize for the inconvenience this issue may have caused. We are gratified that you have made Hotmail the world's most popular free e-mail provider, and are committed to further improving the award-winning service in the months ahead. ---------------------------------------------------------------------- In all their (Microsoft's) official statements they were saying that Microsoft Passport is secure, and the "hackers" did not enter to Hotmail trough it. Their explanation was that they were hit by unknown security breach. Rob Bennett, Microsoft's director of marketing, commented: "The situation was that there was a hacker who wrote some advanced code to basically bypass the Hotmail login process. This person did have very specific knowledge of how to write development code, and put up a website apparently that allowed people to put in a user name. That code does not work anymore and there should be no future attacks from this person". this statement is really silly. Let's look into it little bit closer. Is this - http://207.82.250.251/cgi-bin/start?curmbox=ACTIVE&js=no&login =username &passwd=eh - advanced code??? Not. It is just a simple address. Are those people who found it hackers? Not. They didn't hack into anything, they just found a backdoor in Hotmail service which let them inside any account. It looks like that the main party to blame over here is Microsoft. But we could look at it with some other aspects. That group Hackers Unite had to report the bug to Microsoft, because security is the first thing that matters. They didn't report it, and chaos started. Latest reports say that some people will have problems caused by the Hotmail security breach. Unidentified attackers read e-mails from couple of Swedish prostitutes, and published details, about business manager of a well-known Swedish media company wanting their "services", on an anonymous web-site in the USA. He later said that this is nasty, and that he understands that this can lead to rumors - "I just wanted to know if they really were prostitutes and I never paid for sex with the prostitutes" - he said. Did this Hotmail security breach showed Microsoft engineers to test their programs and servers little bit more, or it will just start chaos related to on-line privacy? Future will show. If you are Hotmail user, and you are paranoid about your privacy, you could always use Hushmail (www.hushmail.com), who offers Web-based 1,024-bit encryption technology through a Java applet. Berislav Kucan aka BHZ bhz@net-security.org http://net-security.org XIII. Meet the underground -------------------------- Special about Beglian Hacker Szene / Bust of RedAtack. Intervied CUM ( Crew Madness Underground ) I had a little interview with toxic from CUM, Belgiums best h/p/v/c/a group. Check his statements about The RedAttack bust and about the Belgian hacker scene. <--begin interview-- deepcase: ok, tell something about the belgium scene ! toxic : There isn't much to tell about that.. we used to have a quite "close" scene in the BBS era.. but that's now gone with the Internet... You don't have much belgian groups anymore... with the internet it's like more the individual that counts i guess..., still there are some very good belgian guyz like m0n from cha0s, d0mz, segfau|t, n3m0, socked, deepcase, g_rax ... deepcase: something about CUM, what yu do, why, since when etc. CUM was founded in 1996, this when Hacker, Immortal Intruder, Fiber Optic and I (Toxic Ocean) met IRL for the first time... in that time Hacker was running a multi-node warez board ("Unusual Project"), Immortal and Fiber had one of the biggest h/p/a/v/c board in Belgium ("Hacker Town")... and i was a frequent caller of both boards.. We shared some common interests like hacking, computer security - and just plain computer phun :) .. so we decided to start our own group, in the beginning just to share ideas and files, and later to test new technologies, security, gather knowledge... we really aren't a "defacing" group, as we think that's rather lame... when we hack a server, we keep the access to learn and explore.. not to deface the page and have our moment of fame... but since these times you need to deface a page to be taken "serious" , we now and then deface a page .. but then mostly stupid servers with nothing on it .. lately we also begun to explore more "hardware" stuff - this is why we founded the CUM-tech-lab, our own lab with all kindsa computers to "test things out".. we also begun exploring the phone system, and GSM nets... right now we're writing a "Belgian Phreak/Phonephun Guide" for all belgian (and other) h/p/a/v/c'ers , with in it up-to-date info, technical details and usefull tricks. deepcase: what you think about RedAttack man toxic : He's a wannabe. A kiddie who thinks he's the best hacker on earth. With this we can live, you just ignore guys like that. But what's really scary is that a lot of people buy his shit. In an interview with a belgian magazine, he was so full of shit, it made me sick. Example : he claimed he had hacked the largest bank of Belgium ("Generale Bank"). He said it took him AND a team 3 weeks and a hell of a lot maths to get the job done. Reality : the password of the helpdesk was "hlpdsk". Need I say more. The only thing he got was a few internetbanking usernames, no passwords. Big deal. He went to the media with this. Ofcourse they believed he had hacked into the core of the banks mainframe, you know the media. The whole thing is blown out of proportion. He's also claiming that there aren't other hackers in Belgium and shit like that. But just a few days ago, his own website got hacked ;) deepcase: whats yur comment on his bust toxic : His early bust proves he's not really that good, it took us just 1 e-mail to get his name and real IP address, so... But now he wants everybody to believe he's a crusader on a mission. A mission of cleaning the internet. He wants to ban all "harmfull" content from the net, stuff like "how to make a pipebomb". What happened to free speech?? Not to mention that you can also find all these things in ur local library... This explanation is crap, he's only telling this because he doesn't wanna go to jail and wants to have a "clean" image... He's a media wh0re, a kiddie who wants his 5 minutes of fame... Even worse, because of him the politicians are now making laws against "computer criminals". Before redattacks media exposion, there were no such laws here in Belgium... deepcase: you knew him? toxic : Nope, never heard of him before he was on tv... <--end interview-- deepcase deepcase@net-security.org XIV. Freedom of speech - related incidents ------------------------------------------- ******************************************************************* The most certain test by which we judge whether a country is really free is the amount of security enjoyed by minorities. --- Lord Acton ******************************************************************* Every day the battle between freedom and repression rages through the global ether. Here are this week's links highlights from NewsTrolls(http://www.newstrolls.com): Thursday, August 26: Australia's newly passed censorship laws make it the <http://www.wired.com/news/news/business/story/21425.html> Internet's "village idiot"... 30 Chinese Protestant house church leaders <http://www.insidechina.com/news.php3?id=88013> arrested... Students, artists, religious, and intellectuals have long been targets for repressive regimes <http://www.insidechina.com/news.php3?id=88025> but now even FARMERS in China are being tried for subversion... "Dozens of farmers will be tried for subversion in China's southwest autonomous city of Chongqing for establishing an "anti-corruption army" and calling for the reassessment of the 1989 Tiananmen democracy protests, a human rights group said Thursday." Malaysians rally around Lim <http://www.scmp.com/News/Asia/Article/FullText_asp_ArticleID-1999082603171397 9.asp> finally free from prison... "Mr Lim, who had clearly lost weight but was in good spirits, took up the multi-racial theme in his first remarks after his release. He said he had been condemned as a Chinese chauvinist but he was just "championing the rights of the people". He said he was "a true Malaysian" who was "fighting for a just society". Mr Lim said he would continue the struggle and was "prepared to go to jail again". He stood on the roof of a car with his father, Lim Kit Siang, the DAP secretary-general, and said he was he was pleased to breathe fresh air again but would not feel really free until all Malaysians who were "unfairly in prison" were freed." Weekend, August 27-29 FCC approves <http://www.epic.org/privacy/wiretap/calea/fcc_decision_release_8_99.html> wiretaps on networks... Monday, August 30 Press Freedom Violated In <http://www.africanews.org/atlarge/stories/19990827_feat3.html> 15 Francophonie States Press freedom advocate arrested <http://www.africanews.org/central/congo-kinshasa/stories/19990826_feat2.html> in Kinshasa Czech firm builds wall <http://www.cnn.com/WORLD/europe/9908/30/BC-CZECH-WALL.reut/> isolating gypsies... Tuesday, August 31 China has tortured to death <http://www.insidechina.com/news.php3?id=88997> three Tibetan monks... 250 protest outside the World Bank as the bank promises to investigate <http://www.insidechina.com/news.php3?id=88795> their project in Occupied Tibet After a 98.6% voter turnout <http://news.bbc.co.uk/hi/english/world/asia-pacific/newsid_434000/434647.stm> anti-independence faction turns violent in East Timor and yet the UK is continuing to <http://news.bbc.co.uk/hi/english/uk_politics/newsid_434000/434350.stm> sell arms to Indonesia... UN says Indonesian military <http://asia.yahoo.com/headlines/310899/world/936110760-90831144608.newsworld. html> took part in violence Nigerian youths speak out against the <http://www.africanews.org/business/stories/19990830_feat23.html> Niger-Delta Development Commission... ""We don't need a commission. Bureaucrats would just come, hijack it and siphon all the money sunk in it to the detriment of the masses."...As a way forward to restore normalcy in the Niger Delta region, Mr. Igboku-Otu, who is also the President of Civic Rights Organisation, posited: "I will urge President Obasanjo not to listen again to our elders who visit him in Aso Rock. He should make them irrelevant and now consult directly with the youth via their umbrella organisations and within 24 hours, the Niger-Delta problem will be over. "Let me tell Obasanjo that all the arms brought to the Niger -Delta are bought by these same people who visit him in Abuja in the name of Niger-Delta. Where does the helpless youth have 3,000 dollars to buy AK 47?" he queried." Wednesday, September 1 10-year-old Tibetan boy spends 4 months in jail because <http://www.tibet.ca/wtnarchive/1999/9/1_4.html> he refused to say he was a Chinese citizen... "Luodeng Chideng was horrified when the police led away his 10-year-old son because the boy refused to repeat the phrase "I am a Chinese citizen" in school, insisting instead that he is Tibetan. The boy spent four months behind bars. He was released only when Luodeng bribed a police officer who, adding a final insult, warned the father not to let it happen again. "It was my fault he got arrested," Luodeng said later, shaking his head. "I'm the one who taught him to be proud he is Tibetan." Liu Qing, Chinese democracy activist, on the use of the Internet in <http://www.insidechina.com/news.php3?id=89096> leading the protest war against China's PRC Khamenei slams Iranian journalists who <http://asia.yahoo.com/headlines/010999/world/936190560-90901125649.newsworld. html> question Islam's vengeance laws... ""Any newspaper or writer wanting to renounce the fundamental principles of Islam or questioning the vengeance law is an apostate and liable to the death penalty," Khamenei told a gathering of several thousand troops in the northeastern town of Mashhad." A "union of revolutionary writers" protesting consumerism <http://www.nytimes.com/aponline/i/AP-Russia-Explosion.html> take responsibility for Kremlin bomb... "``Acts like those taken today create a social engine which is still experimental, but is gradually becoming a real social factor,'' the note read, according to a spokesman at the FSB. ``A hamburger not eaten to the end by the dead consumer is a revolutionary hamburger. Consumers: We don't like your way of life and it's unsafe for you.''" In just one week... diva aka Pasty Drone CEO NewsTrolls, Inc. http://www.newstrolls.com pastydrone@newstrolls.com XV. Microsoft Installs US Spy Agency with Windows --------------------------------------------------- Research Triangle Park, NC - 31 August 1999 - Between Hotmail hacks and browser bugs, Microsoft has a dismal track record in computer security. Most of us accept these minor security flaws and go on with life. But how is an IT manager to feel when they learn that in every copy of Windows sold, Microsoft has installed a 'back door' for the National Security Agency (NSA - the USA's spy agency) making it orders of magnitude easier for the US government to access their computers? While investigating the security subsystems of WindowsNT4, Cryptonym's Chief Scientist Andrew Fernandes discovered exactly that - a back door for the NSA in every copy of Win95/98/NT4 and Windows2000. Building on the work of Nicko van Someren (NCipher), and Adi Shamir (the 'S' in 'RSA'), Andrew was investigating Microsoft's "CryptoAPI" architecture for security flaws. Since the CryptoAPI is the fundamental building block of cryptographic security in Windows, any flaw in it would open Windows to electronic attack. Normally, Windows components are stripped of identifying information. If the computer is calculating "number_of_hours = 24 * number_of_days", the only thing a human can understand is that the computer is multiplying "a = 24 * b". Without the symbols "number_of_hours" and "number_of_days", we may have no idea what 'a' and 'b' stand for, or even that they calculate units of time. In the CryptoAPI system, it was well known that Windows used special numbers called "cryptographic public keys" to verify the integrity of a CryptoAPI component before using that component's services. In other words, programmers already knew that windows performed the calculation "component_validity = crypto_verify(23479237498234...,crypto_component)", but no-one knew exactly what the cryptographic key "23479237498234..." meant semantically. Then came WindowsNT4's Service Pack 5. In this service release of software from Microsoft, the company crucially forgot to remove the symbolic information identifying the security components. It turns out that there are really two keys used by Windows; the first belongs to Microsoft, and it allows them to securely load CryptoAPI services; the second belongs to the NSA. That means that the NSA can also securely load CryptoAPI services... on your machine, and without your authorization. The result is that it is tremendously easier for the NSA to load unauthorized security services on all copies of Microsoft Windows, and once these security services are loaded, they can effectively compromise your entire operating system. For non-American IT managers relying on WinNT to operate highly secure data centers, this find is worrying. The US government is currently making it as difficult as possible for "strong" crypto to be used outside of the US; that they have also installed a cryptographic back-door in the world's most abundant operating system should send a strong message to foreign IT managers. There is good news among the bad, however. It turns out that there is a flaw in the way the "crypto_verify" function is implemented. Because of the way the crypto verification occurs, users can easily eliminate or replace the NSA key from the operating system without modifying any of Microsoft's original components. Since the NSA key is easily replaced, it means that non-US companies are free to install "strong" crypto services into Windows, without Microsoft's or the NSA's approval. Thus the NSA has effectively removed export control of "strong" crypto from Windows. A demonstration program that replaces the NSA key can be found on Cryptonym's website. Cryptonym: Bringing you the Next Generation of Internet Security, using cryptography, risk management, and public key infrastructure. Interview Contact: Andrew Fernandes Telephone: +1 919 469 4714 email: andrew@cryptonym.com Fax: +1 919 469 8708 Cryptonym Corporation 1695 Lincolnshire Boulevard Mississauga, Ontario Canada L5E 2T2 http://www.cryptonym.com