Trane ComfortLink XL850 thermostats running firmware version 3.1 or lower are vulnerable to information disclosure and remote access due to a weak authentication mechanism and hardcoded credentials. The device uses a custom protocol and a predictable port number to administer remote access to virtually all of the device functions. When you combine hardcoded credentials with a network accessible port, you have a device ripe for attack from the network or even an attack from the Internet if the thermostat is exposed through the router.

Once an attacker has gained access they can quickly extract all information from the device including the home heating and cooling schedule, current operation mode, current temperature, chat and alarm history, serial number, active socket connections, trusted URLs, secret IDs, software version info and detailed address and installer information. These will allow attackers to perform a number of dangerous operations. This includes forcing the device to maintain the maximum heating setting or disabling the device continuously thereby overriding user input. Attackers can also remove and create trusted server connections permanently disconnecting the device from the corporate command and control servers.

Below shows the exploit that affect the device. The "Get Connected" banner at the top of the screen is a marketing prompt indicating that the device is not enrolled in any remote services or special features.

Hacking of Facebook Messenger

Recently Check Point disclosed a vulnerability found in Facebook Messenger, it allows an attacker to change conversation thread in the Facebook messenger.

Hacker can manipulate message history of a conversation to claim he had reached a falsified agreement with the victim, or simply change its terms.

Hackers can tamper, alter or hide important information in Facebook chat communications which can have legal repercussions. These chats can be admitted as evidence in legal investigations and this vulnerability opened the door for an attacker to hide evidence of a crime or even incriminate an innocent person.

This vulnerability can also be used as a malware distribution. An attacker can change a legitimate link or file into a malicious one, and easily persuade the user to open it. The attacker can use this method later on to update the link to contain the latest C&C address.

Below is the demo of the hack

Hijack and Impersonate Whatsapp account

Attacker are able to hijack a Whatsapp account and impersonate as the legitimate user.
How they do it?  There is actually a vulnerability in Signaling System 7 (SS7), a global network of carriers that acts as a central hub to connect the world. The attack is done by tricking the telecom network into believing the attacker’s phone has the same number as the target’s.

The attacker would now create a new WhatsApp account and receive the secret code that authenticates their phone as the legitimate account holder.Once complete, the attacker now controls the account, including the ability to send and receive messages.

Below is a demo of the attack.

You can find my previous post on extracting messages from Whatsapp in "Can you extract message and photo from Whatsapp?"

Hacking of LG handphone

Check Point disclosed today two vulnerabilities (CVE-2016-3117, CVE-2016-2035) which can be used to elevate privileges on LG mobile devices to attack them remotely at the LayerOne 2016 conference in Los Angeles.

The first vulnerability allows a malicious app installed on an LG device to abuse the lack of bind permissions in an LG service and to elevate its privileges, allowing additional control of the device.
The second vulnerability allows a remote attacker to delete or modify SMS messages received on a device. Attacker could use it to conduct credential theft or to fool a user into installing a malicious app. The attacker could modify a user’s unread SMS messages and add a malicious URL to redirect the user to download a malicious app or to a fake overlay to steal credentials.

Steps to mitigate the risk of this attack:
- Verify any app installation request before accepting it to make sure it is legitimate.
- Use a personal mobile security solution that monitors your device for any malicious behavior.

- Lookout for LG latest update on these vulnerabilities and patch it immediately

Below is the video demo of the remote attack.

For more details of these vulnerabilities, visit "OEMs Have Flaws Too: Exposing Two New LG Vulnerabilities"
http://blog.checkpoint.com/2016/05/29/oems-have-flaws-too-exposing-two-new-lg-vulnerabilities/ 

USB hacking obsolete?

With Windows autorun feature disabled by default, USB hacking method such as Pod slurping and tronjanized flash drive no longer possible?

I have recently wrote an article "Pentesting with Teensy" for PenTest Magazine that describes how you can emulate a device as a HID (Human Interface Device) and inject attack codes and execute commands in the system.

For those who have not read the article, I have make a short video to demostrate how you can still carry out the USB hacking using Teensy.

Besides using teensy as a pentesting or hacking tool, it can also be useful for auditors to verify system hardening and configuration with system commands pre-set into the device.

More information about my article, refer to my previous post "Pentesting with Teensy".

Can you extract message and photo from Whatsapp?

One day while messaging to my friend using Whatsapp, he ask me if the traffic is secure? I did a bit of read up and found out that Whatsapp message was actually not encrypted unlike iMessage.

So I decided to do a simple video to show how you can extract message and photo that were send via Whatsapp.



Update!
New post on hijacking and impersonate Whatsapp account in "Hijack and Impersonate Whatsapp account"

Android vs iOS security

A interesting video on well-known security researcher Dr Charlie Miller, which discuss the security postures of Android and iOS

Test Drive OmniPeek 6.6

Last week, WildPackets released OmniPeek 6.6, the first network analyzer with 802.11n 3-stream wireless support. You can test it out but downloading the Wireless Essentials Pack. The pack includes the OmniPeek Enterprise 6.6 demo software as well as three popular wireless add-ons: Wireless Signal Stats, Wireless Channel Aggregator, and Roaming Latency Analyzer.

The video below with Jay Botelho, Director, Product Management, and Chris Bloom, developer and evangelist of WildPackets will tell you all about OmniPeek's wireless capabilities.

XSS found in Linkbucks.com

Linkbucks.com website was found to be vulnerable to Cross Site Scripting(XSS) vulnerability, which could be exploited using malicious scripts.



Vulnerability Description:
==================
Linkbucks.com is a famous advertising network site that brings web users, websites and marketers together. The XSS vulnerability is found in the Default.aspx page. Script can be injected to the Message and Returnurl parameters. This can be exploited by injecting arbitrary HTML and malicious script code, which will execute in a user's browser session. Unvalidated redirection and forwarding is also possible.

Vulnerability testing:
===============
Vulnerable URL: http://www.linkbucks.com/Default.aspx?
Tested with: Firefox 3.5 and Internet Explorer 7 on Windows XP SP3

A simple "alert("You are hACked by w01f")" script was injected to the "Default" page. It was executed and display on the web browser. Malicious script could be executed using this method.



Below is the video demonstration on exploiting the XSS vulnerability using redirection. It will redirect to my blog. Hacker can redirect to a spoofed Linkbucks site with malicious code.



Remediation:
==========
The Message and ReturnURL parameters need to be properly sanitized after a user's logging out. The Linksbuck support team was contacted on the vulnerability. The support ticket is "#KHT-97974-227" but so far no fixed was done.

Windows Lnk Exploit Protection Tool

The Recent Microsoft vulnerability in Windows Shell could allow Remote Code Execution such as using shortcut. Many malwares were found exploiting this vulnerability. Sophos had recently released a free protection tool that claims to be able to detect and block this Windows shortcut exploit from running. It will also work with your existing Anti Virus.

The tools can be downloaded from this official website.

Below is the demo video of the tools


Related Report:
- TechNet: Microsoft Security Advisory (2286198)

Disclamer: I do not in any way endorsed this tool nor responsible for any problem or issue cause by it.

FM200 in action

Most IT security professional should have heard of FM200. System administrator should have seen the FM200 caution sign (shown on left) outside the Data Centre.

If you happen to walk around your data centre, you might see several tanks of FM200 (like those shown below).

When i was working in the Government Data Centre many years back, i was told that it will cost me $20K if i accidentally triggers it.

So unless you have extra $20K to spare or that is a major fire outbreak in your data centre. You are unlikely to see FM200 in action. But i happen to come across this video that will not cost you $20K. :)

NetWars CyberChallenge

US Companies and government agencies face a critical shortage of cybersecurity experts with sufficient technical skills to protect their systems, and military organizations have a similar shortage of people who can fight and win in cyberwar.

An initiative by US government of having some Cyber Challenge competitions to discover these talented people. One of the competition was NetWars by SANS institute. Below is the video of an interview with the winner (Alan Paller) of NetWars at Gov 2.0 Summit 09.

Hope this video can motivate talented kids who is interested in IT Security.



Related Links:
- US Cyber Challenge
- NetWars Competition
- Interview with Top talent from Round 2

Emerging Internet Security Threats: Spring 2009

Saw this video by Lenny Zeltser, the instructor for my GIAC Reverse-Engineering Malware(GREM) certification. Most of the stuffs presented may not be new to you, but it provide as a reminder with real life examples on some of the "attacks".

This video explores today's emerging Internet security threats to help organizations fine-tune their defenses. He examines attack patterns that have included the use of email as a gateway for fraud, the mighty power of network bots, the fertile ecosystem for web-based attacks, and the increased precision of modern attacks. The presentation presents lots of real-world examples of cyber attacks, and discusses the financial incentives behind the malicious activities that occur on the Internet.

He also covers:

• What is driving modern-day attackers to large-scale and targeted attacks
• Which recent breaches exemplify threat categories organizations need to track
• The approaches Internet criminals employ to trick victims and bypass defenses
• Whether you should adjust security architecture to match today's threat landscape

Part 1


Part 2


Part 3


About the speaker: Lenny Zeltser leads a security consulting team at Savvis. He is also a board of directors member at SANS Technology Institute, a SANS faculty member, and an incident handler at the SANS Internet Storm Center. Lenny frequently speaks on information security and related business topics at conferences and private events, writes articles, and has co-authored several books. Lenny is one of the few individuals in the world who has earned the highly regarded GIAC Security Expert (GSE) designation. He also holds the CISSP certification. Lenny has an MBA degree from MIT Sloan and a computer science degree from the University of Pennsylvania. For more information about his projects, see www.zeltser.com.

Can you build a WIFI Jammer?

I have previously blog on portable WIFI jammer and receive several feedback asking whether it is possible to build a WIFI jammer using device that transmit with frequency of 2.4GHz.

As most people know, common WIFI network such as 802.11b and 802.11g uses the frequency of 2.4 GHz. Many articles in the internet claims that it is possible to build a WIFI jammer. Some even claim that you can build your own WIFI jammer using a 2.4GHz cordless phone.

I happens to have a AV transmitter that uses 2.4GHz and decided to do this simple video to see if it can jam a WIFI connection.

How Secure is your forum login?

After doing a video on sidejacking, i received comments and feedbacks asking on bypassing other web login that does not use SSL(HTTPS). So i decided to do a simple video to show how easy to collect user's login credential on unsecured website. The most common unsecured login is Internet forum.

In this video, i will sniffed the web traffic and extracted the username and password. This particular forum uses MD5 hash to protect the password. But common hash values can be search from the Internet. Even if the hash value cannot be found(due to strong password), you can still use the captured login data to login as the user via a webproxy.

Sidejacking with Ferret and Hamster 2.0

Recently, i was requested by a friend to help him on doing a wireless hacking demo. Besides the WEP cracking tool "Aircrack-NG", sidejacking tools "Ferret and Hamster" also comes to my mind. The last time i tested those tools were early last year. So i decided to revisit the sidejacking tools and make a video of it.

Abit on "Ferret and Hamster", it was written by Robert Graham and was officially released during the Defcon conference in 2007, where he log into a list of victims' webmail (shown on a the big screen such as Gmail, Hotmail). Those victims were actually the audience that were still using their webmail during presentation.

This tool actually sniff the network traffic (either wireless or wired) and extract the session-id from the HTTP cookies. Many web sites use SSL encryption for login pages to prevent attackers from seeing the password, but do not use encryption for the rest of the site once authenticated. With the session-id, you can gain access to the victim's account without the need of username and password.



Updated
After posting the video on sidejacking, i feel that i should also provide some simple advise to user on protecting against such attacks.

1> Make sure you use "HTTPS" in your broswer address (e.g "https://mail.google.com") when accessing the login page of a web application, such as Gmail or Hotmail.

2> Check your web application setting whether there is any option to use only SSL(HTTPS) connection. For Gmail, you can set to "Always use https" (shown below).

3> To confirm if your connection is secured after logging in, check to see if there is a "lock" icon in the Status Bar on bottom right of your browser.

IPv6-101: Whats new in IPv6?

It's been coming for some time now. We are hearing about IPv6 since ages, but for every IP crunch, some or the other technology has extended the life of IPv4 (the last and very important) like local IPs and NATs. Beijing Olympic 2008 was IPv6 compatible, Cisco wants to make its all networking equipments IPv6 enabled, Google is on IPv6 and US DoD has made it compulsory to support IPv6 for every new deal... looks like we have to learn about IPv6 sooner rather than later.

The version of IP currently being used on the internet is IPv4 and is around for 20 years. IPv4 is remarkably resilient in spite of its age, but it is beginning to have problems. The most serious problem with IPv4 is shortage of IP address space for internet growth. IPv6 has much larger address space than IPv4. IPv6 uses 128bit address as compared to just 32bit address space used by IPv4. The new address space thus supports 2128 addresses. This expansion eliminates NATing, gives flexibility in allocating addresses and routing. The other important features implemented by IPv6 include stateless auto-configuration, network renumbering with router announcements, standard subnet size, mandatory security at network layer etc. As of now IPv6 is implemented on all major operating systems in use in commercial, business, and home consumer environments.

This video is about important features of IPv6. It starts with, how to check that your computer is IPv6 enabled or not and then discusses the main features like

- Extended address space
- Auto-Configuration
- Simplified header formats
- Improved support for options and extensions
- Security at internet layer
- Better routing decisions etc.


You can also view the video from SecurityTube


Note:
Thanks networkwiz for sharing his IPv6-101 video series. It will start with the basic introduction to IPv6 protocol. This video series will serve as a IPv6 tutorial for beginners and will help as a quick reference for advanced users. I will try to add more and more practical examples and real life scenarios in IPv6 tutorial video series along with the theoretical explanation