Trane ComfortLink XL850 thermostats running firmware version 3.1 or lower are vulnerable to information disclosure and remote access due to a weak authentication mechanism and hardcoded credentials. The device uses a custom protocol and a predictable port number to administer remote access to virtually all of the device functions. When you combine hardcoded credentials with a network accessible port, you have a device ripe for attack from the network or even an attack from the Internet if the thermostat is exposed through the router.

Once an attacker has gained access they can quickly extract all information from the device including the home heating and cooling schedule, current operation mode, current temperature, chat and alarm history, serial number, active socket connections, trusted URLs, secret IDs, software version info and detailed address and installer information. These will allow attackers to perform a number of dangerous operations. This includes forcing the device to maintain the maximum heating setting or disabling the device continuously thereby overriding user input. Attackers can also remove and create trusted server connections permanently disconnecting the device from the corporate command and control servers.

Below shows the exploit that affect the device. The "Get Connected" banner at the top of the screen is a marketing prompt indicating that the device is not enrolled in any remote services or special features.

Hacking of Facebook Messenger

Recently Check Point disclosed a vulnerability found in Facebook Messenger, it allows an attacker to change conversation thread in the Facebook messenger.

Hacker can manipulate message history of a conversation to claim he had reached a falsified agreement with the victim, or simply change its terms.

Hackers can tamper, alter or hide important information in Facebook chat communications which can have legal repercussions. These chats can be admitted as evidence in legal investigations and this vulnerability opened the door for an attacker to hide evidence of a crime or even incriminate an innocent person.

This vulnerability can also be used as a malware distribution. An attacker can change a legitimate link or file into a malicious one, and easily persuade the user to open it. The attacker can use this method later on to update the link to contain the latest C&C address.

Below is the demo of the hack

Hijack and Impersonate Whatsapp account

Attacker are able to hijack a Whatsapp account and impersonate as the legitimate user.
How they do it?  There is actually a vulnerability in Signaling System 7 (SS7), a global network of carriers that acts as a central hub to connect the world. The attack is done by tricking the telecom network into believing the attacker’s phone has the same number as the target’s.

The attacker would now create a new WhatsApp account and receive the secret code that authenticates their phone as the legitimate account holder.Once complete, the attacker now controls the account, including the ability to send and receive messages.

Below is a demo of the attack.

You can find my previous post on extracting messages from Whatsapp in "Can you extract message and photo from Whatsapp?"

Hacking of LG handphone

Check Point disclosed today two vulnerabilities (CVE-2016-3117, CVE-2016-2035) which can be used to elevate privileges on LG mobile devices to attack them remotely at the LayerOne 2016 conference in Los Angeles.

The first vulnerability allows a malicious app installed on an LG device to abuse the lack of bind permissions in an LG service and to elevate its privileges, allowing additional control of the device.
The second vulnerability allows a remote attacker to delete or modify SMS messages received on a device. Attacker could use it to conduct credential theft or to fool a user into installing a malicious app. The attacker could modify a user’s unread SMS messages and add a malicious URL to redirect the user to download a malicious app or to a fake overlay to steal credentials.

Steps to mitigate the risk of this attack:
- Verify any app installation request before accepting it to make sure it is legitimate.
- Use a personal mobile security solution that monitors your device for any malicious behavior.

- Lookout for LG latest update on these vulnerabilities and patch it immediately

Below is the video demo of the remote attack.

For more details of these vulnerabilities, visit "OEMs Have Flaws Too: Exposing Two New LG Vulnerabilities"
http://blog.checkpoint.com/2016/05/29/oems-have-flaws-too-exposing-two-new-lg-vulnerabilities/ 

Information Leakage and Improper Error Handling

Information leakage and improper error handling used to be in the OWASP Top 10 2004 and 2007. But they have rename to "Security Misconfiguration" since 2010 and with a wider scope.

While doing my online shopping today, I accidentally triggered an SQL query timeout error. The error page review quite a number of information, which can be useful for the programmer to carry out troubleshooting. But best of all, it also provide the hacker with information to carry out the next level of "attack" to the server.

The error page provides table information, file paths that helps in launching SQL injections and XSS attacks.

The error page also shows the application that the server is using and its version number. Based on the information, the Microsoft .NET framework version is not the latest. It may contains critical vulnerability that allows elevation of privileges and remote code execution.

Planning to inform the Site administrator on this issues and nobody hacked it yet.

USB hacking obsolete?

With Windows autorun feature disabled by default, USB hacking method such as Pod slurping and tronjanized flash drive no longer possible?

I have recently wrote an article "Pentesting with Teensy" for PenTest Magazine that describes how you can emulate a device as a HID (Human Interface Device) and inject attack codes and execute commands in the system.

For those who have not read the article, I have make a short video to demostrate how you can still carry out the USB hacking using Teensy.

Besides using teensy as a pentesting or hacking tool, it can also be useful for auditors to verify system hardening and configuration with system commands pre-set into the device.

More information about my article, refer to my previous post "Pentesting with Teensy".

Command Your Windows

System these days does not really require users to use command line. Windows, Mac, Linux and even traditionally command-based UNIX also come with GUI (Graphical User Interface) such as KDE. Command line may seem to be obsolete for many. But it is still very useful to hackers and pen-testers when GUI is not available such as using remote shell.

I have wrote an article titled "Command your Windows", which is published in this month PenTest magazine (September). In this article, I will be sharing on some of the useful windows commands that a hacker or pen-tester can use when obtaining a remote shell to the system.

This magazine can be purchase on-line from PenTest Magazine website.

Please post your comments regarding this article here.
If you are interested in this article, I will happy to share it with you. Just drop me an email.

Pentesting with Teensy

Windows autorun feature is disabled by default these days. Is it still possible to launch code automatically from a USB drive? What if there is a USB drive that could execute code automatically when plugged in and yet not able to be identify as USB drive by the system?

Teensy, USB-based micro-controller development board, which can be programmed to emulate as any device and store programming code. I have wrote an article that describes how you can emulate the device as a HID (Human Interface Device) and inject attack codes and execute commands in the system.

This article titled "Pentesting with Teensy" can be found in the July issue of PenTest (Web App) Magazine.

This magazine can be purchase on-line from PenTest Magazine website.

Please post your comments regarding this article here.
If you are interested in this article, I will happy to share it with you. Just drop me an email.

WhatsApp InSecurity

The ownership of smartphones and tablets has grown enormously over the past few years. WhatsApp has gained popularity as the cross-platform application to replace traditional messaging services such as Instant Messaging and SMS. How safe is it to use for personal communication?

I have written an article that talks about how you can extract the message and photo that were send via WhatsApp.

This magazine can be purchase on-line from Hakin9 Magazine website.

Please post your comments regarding this article here.
If you are interested in this article, I will happy to share it with you. Just drop me an email.

There is a video on the related demonstration, which I previously posted in "Can you extract message and photo from WhatsApp"

Can you extract message and photo from Whatsapp?

One day while messaging to my friend using Whatsapp, he ask me if the traffic is secure? I did a bit of read up and found out that Whatsapp message was actually not encrypted unlike iMessage.

So I decided to do a simple video to show how you can extract message and photo that were send via Whatsapp.



Update!
New post on hijacking and impersonate Whatsapp account in "Hijack and Impersonate Whatsapp account"

Default again?

Another device found to be using default password. This time is a home router in Korea. It is a DAVOLINK DVW-2000N router.




w01f advise: Home router console should not be accessible from the Internet. The account should also be properly secured with strong password.

"Easy" access to exam questions?

While doing my "googling" and security analysis, i happen to come across a Shanghai school portal and manage to easily "gain access" into the "admin" account.



With the admin access, i am able to access to all the documents in the portal. Wondering if there are any exam questions in there?



I can do a listing of all the user account, which i can edit or delete.

w01f advise: Web portal should be proper secured, especially the administrative account. Strong password should also be used by all users.


Disclaimer: Only access to the "main" and "user account" page, no modification to the portal and no download of any files from this portal. It is purely for security awareness purpose with no malicious intent.

Should print server be secured?

Recently, there are many news on data lost of customer information, product designs and algorithms from big corporation. WikiLeaks that exposed sensitive communication. Printers can be one of the good source of data leakage.

When surfing and "googling" around the Internet, we still see many print servers accessible from Internet. Some of these print servers were even configured with default login credential.

Beside data leakage, you can also create some disruptions to their business by making unauthorized changes.

Below are some examples, which i manage to gain access.



From the Admin console, we can access the "System Tools".




We can also make changes in "Advanced Setting".




w01f advise: Print server should not be accessible from the Internet. If access from the Internet is required, make sure it is properly secured and change all default login.

Hacker for Hire

Recently i receive an Marketing Email which sell hacking guides, tools, services and even hiring a hacker.

The hacking guide they are selling includes:
- Credit card hacking
- Bypass Virtual keyboard in Internet banking
- Exploit and malware development

They also selling tools like
- Polomorphic Crypter's (to bypass AV Scantime,runtime)
- Paid Botnets
- IRC Bots
- Exploit packs

Services such as
- VPN Encrypted Connection (Hide your real Ip Address)
- Fake Emailer or Email Bomber
- DDOS attacks

If you dont know anything about hacking, you can ever hire a hacker to do the job.



They even have a website that allow you to order their service online. Even hacker give discount.

Swiss Cyber Storm Cargame Challenge

Swiss Cyber Storm 3 is having a online January CarGame challenge. It is a Pen-testing wargame that you have to gain access into a vulnerable web application. Try to solve this challenge and win a new car.

Challenge Description
In Hacking-Lab, it provides a vulnerable web application - and somewhere on the web server you will be able to disclose a backend server DB connection properties file including hostname, IP, username and password. It is your goal to disclose this DB property file and then get a SQL connection to the database server. This DB server is vulnerable too! Please gain interactive access on the database server and proof your access by sending a screenshot of having access, some server info you gather with commands like "hostname" or similar.

Goal
Gain interactive access to the database server. Proof you are able to access the box.

Details
You must be authenticated and registered for the January 2011 CarGame Challenge in Hacking-Lab to see the full details of this wargame!

More details - http://www.hacking-lab.com/cases/7025-database-hijack-cargame-challenge/index.html

Challenge Registration - http://www.hacking-lab.com/events/registerform.html?eventid=137

Watch Intro video (on how to participate)

Official Swiss Cyber Storm 3 website

Eleonore exploit pack

Exploit packs have been selling in the underground for hundreds of dollars in recent years. These pre-packaged kits are designed to probe the visitor’s browser for known security vulnerabilities, and then use the first one found as a vehicle to quietly install malicious software. They normally comes with a Web administration page, which gives the attacker real-time statistics about victims, such as which browser exploits are working best, and which browsers and browser versions are most successfully attacked. Those commonly found in the market were iPack, Crimepack and Eleonore.

The latter, Eleonore, is the most popular kit and have been making the headlines recently. It is claim to cost between USD$500 - USD$1000 (based on the version). The package was updated approximately every month with the latest browser, PDF and Java vulnerabilities. These kit providers provide "secured" support, updates and even cleanup of the package service if necessary.


Eleonore Web administration page


Crimepack Web administration page

w01f advise: Always patch up your system, especially Internet browser, Java, Flash and PDF applications.

FireSheep Vs BlackSheep

Firesheep
It is a Firefox extension that demonstrates HTTP session hijacking attacks. HTTP session hijecking (commonly known as Sidejacking) is a common vulnerability, which sniff the network traffic and extract victim's session information or cookie. With the session information, it can gain access to the victim's account without the need of username and password.

I have previously blog on sidejacking with Ferret and Hamster.

Firesheep is free, open source, and is available now for Mac OS X and Windows.



BlackSheep
BlackSheep, also a Firefox plugin is designed to combat Firesheep. BlackSheep does this by dropping ‘fake’ session ID information on the wire and then monitors traffic to see if it has been hijacked. While Firesheep is largely passive, once it identifies session information for a targeted domain, it then makes a subsequent request to that same domain, using the hijacked session information in order to obtain the name of the hijacked user along with an image of the person, if available. It is this request that BlackSheep identifies in order to detect the presence of Firesheep on the network. When identified, the user will be receive the following warning message:



Please note that Firesheep and BlackSheep cannot be installed on the same Firefox instance as they share much of the same code base. If you want to run both Firesheep and BlackSheep on the same machine, they should be installed in separate Firefox profiles.

DotDotPwn 2.1

DotDotPwn is a Directory Traversal Fuzzer. It works on HTTP, FTP and TFTP servers directory traversal vulnerability. It's written in perl language and can be run either under *NIX or Windows platform.

It is written by chr1x (member of our sectester group) and nitr0us. It had just released v2.1, which is more flexible intelligent. So far, 8 security vulnerabilities were discovered by this tools. It was also voted to be included in the next release of the Backtrack Distro.

Well Done chr1x!!

XSS found in Linkbucks.com

Linkbucks.com website was found to be vulnerable to Cross Site Scripting(XSS) vulnerability, which could be exploited using malicious scripts.



Vulnerability Description:
==================
Linkbucks.com is a famous advertising network site that brings web users, websites and marketers together. The XSS vulnerability is found in the Default.aspx page. Script can be injected to the Message and Returnurl parameters. This can be exploited by injecting arbitrary HTML and malicious script code, which will execute in a user's browser session. Unvalidated redirection and forwarding is also possible.

Vulnerability testing:
===============
Vulnerable URL: http://www.linkbucks.com/Default.aspx?
Tested with: Firefox 3.5 and Internet Explorer 7 on Windows XP SP3

A simple "alert("You are hACked by w01f")" script was injected to the "Default" page. It was executed and display on the web browser. Malicious script could be executed using this method.



Below is the video demonstration on exploiting the XSS vulnerability using redirection. It will redirect to my blog. Hacker can redirect to a spoofed Linkbucks site with malicious code.



Remediation:
==========
The Message and ReturnURL parameters need to be properly sanitized after a user's logging out. The Linksbuck support team was contacted on the vulnerability. The support ticket is "#KHT-97974-227" but so far no fixed was done.

Vulnerability found in WPA2

Recently, a vulnerability was found in WPA2 protocol. It is an insider vulnerability where authenticated attacker could launch a "Man in the Middle" attack by decrypting and injecting malicious traffic into the wireless network.

WPA2 is currently the strongest WiFi encryption and authentication protocol available. According to the researcher in AirTight networks, this vulnerability is a design loophole in IEEE 802.11 Standard.

Based on the standard, Group Temporal Key (GTK), which is used to protect broadcast data sent to multiple clients, is using a common shared key. This allows authenticated user to use the common key to encrypt and sends spoofed packets to other clients.

Currently there isn't any patch on this standard.

Related Report:
- NetworkWorld: WPA2 vulnerability found