hrberry.com :: php flaw self-inviting DoS, leaked framework and server info [by, ABK]

Posted@ https://sites.google.com/site/abklabs/home/secured/posts.xml

[]Patched:
Yes

[]Product Name:
http://www.hrberry.com
Payroll Helpdesk, serving several prestigious companies

[]Victim Name:
Ascent Consulting Services Pvt. Ltd.
[http://ascent-online.com]

[]Vuln Summary:
There were validation flaws for GET Request Parameters sent to CAPTCHA image generating PHP script on the Portal.
This allowed attacker to trick the app to generate any number of characters consuming processing power.
It had a timout after 30 seconds (too much) and generated error message with full PATH of PHP file.
Also worked on older un-patched version of OpenSSL.

to read detailed Description... click here

Rapid7's neXpose

Rapid7's neXpose
http://www.rapid7.com/vulnerability-scanner.jsp

You can download the Community Edition of this famous and highly efficient Network Vulnerability Scanner by Rapid7.

[] NeXpose Community Edition provides users with:
 > vulnerability scanning for up to 32 IPs at a time
   {limited, but for free it's nice}
 > Regular vulnerability updates
   {everytime I start it, updates get checked}
 > Accurate scan results
   {it gives real detailed analysis of flaws found}
 > Prioritized risk assessment
   {though its priorities don't match mine most of times}
 > Remediation guidance
   {yeah it's good, with required tweaks}
 > Out-of-the box Metasploit integration
   {from the Metasploit v3.31 it can be fully integrated with NeXpose}
    Link: http://www.metasploit.com/redmine/projects/framework/wiki/NeXpose_Plugin
 > Extensive community support at http://community.rapid7.com
   {it's so easy, you wouldn't require it}
 > Simple deployment
   {if you can browse through a new website, you can use it}
 > No cost start-up security solution
   {Community edition afterall}

on 18-Feb-2010 :: NetWitness reported 'Kneber Botnet' {CRITICAL}

On 18-Feb-2010; NetWitness has reported of new malware 'Kneber botnet';

its a variant of Zeus and mainly target stealing Credentials, Key-logging, etc.

... has affected more than 2500 organizations;

... currently no IPS/IDS have adequate signatures detecting it.

... it can also act with other malwares, fav noticed is Waledac (a P2P Trojan)


[] A try to check if Machine is infected by a Kneber (Zeus Variant), is

        The registry key can be found by following this path, he said:

        HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit

        normally will have an entry like "C:\WINDOWS\system32\userinit.exe,"
        ZeuS will add itself to the list, typically as 'ntos.'
        But could always change its name; so if any un-relevant entries found here... may be machine is infected.

        If any more entries found, or suspicion is there scan the file listed here.


[] Its suggested to patch all latest MS10-* and Adobe releases on all the machines;
    and as always not open suspicious e-mails
   
   
[]NetWitness said that Kneber was primarily found on corporate and government computers, however home users are likely to attract the infestation as well.
   



[] more details @

*** http://www.netwitness.com/resources/pressreleases/feb182010.aspx ***

http://www.networkworld.com/news/2010/021810-kneber-botnet-faq.html?hpg1=bn

http://www.nytimes.com/2010/02/19/technology/19cyber.html?em

http://www.technewsworld.com/rsstory/69372.html

ABK SiteHoster -=[developing a HTTP Network Server to be secure at implementation]=-

ABK SiteHoster 

Sourceforge Link : http://sourceforge.net/projects/sitehoster/ 

Google Code Link : http://code.google.com/p/sitehoster/

Youtube Demo Link: http://www.youtube.com/watch?v=CogPa646vi8

Currently in it's BETA stage and can only serve URL as per HTTP v0.9, so not secure but basic WebServer

Actually developing it as a HTTP Network Server to be secure at its implementation, normally all WebServer present out there are vulnerable cuz they didn't implemented Security at their very core but as an extra sheild outside.
Here in this project I'll be aiming at making it secure from the core itself and making it self-secured by immunizing it from all kinds of Web-App attacks.


ABK SiteHoster is aLEHNS (a Lightweight Extensible HTTP Network Server). Developed in pure Java. Currently supports HTTP 0.9, easily delivering normal HTML oriented WebSites. Aiming to be a full-fledged WebSite Server with all Web Services.

n00bRAT -[Linux Remote Admin Tool]- (Use as Trojan to test your Firewall/IDS)

n00bRAT -[Linux Remote Admin Tool]-

I am working on an open-source undetectable TuX.RAT project, currently in its Beta stage, released at Sourceforge at following link.
Give feedback of how to grow this project... what our geek community wants.

URL :: http://sourceforge.net/projects/n00brat/

::Description::
An undetectable Remote Administration Tool -OR- trojan, an all new approach. Easily usable, Client just requires any Web Browser to control remote machine via WebPage. Fooling firewalls/ids/ips security solutions, as it operates like any web-site.

::Usage::
* Remote Administration Tool for Linux/Unix (POSIX Based Machines)
* Can use it like a Trojan to test your Firewall / IDS / IPS


A Demo Video of Why This? What Code Is? How it Works?
http://www.youtube.com/watch?v=Jnx7nD0qU7M

Scareware / Ransomware [Know Ur Lingo]

[Know Ur Lingo]

Scareware
are the rogue security softwares i.e. malicious softwares pretending to be security solutions working against viruses and worms. It pranks user to feel its need to make the machine secure against some attack or virus infection and gets installed.
Ransomware
are the malwares which hold the infected machine/service/data as hostage, and demand ransom for disinfecting the hostage. ;)

COUNTERMEASURES
if you think you have been infected by such malwares, or wanna minimize the risk of getting infected beforehand... you can use security solutions like
Microsoft Malicious Software Removal Tool : http://www.microsoft.com/security/malwareremove/default.aspx

Or you could get your file scanned by Kaspersky Free Online Virus Scan http://www.kaspersky.com/scanforvirus

ADS [ Alternate Data Stream ] : NTFS - The Dark Side

ADS [ Alternate Data Stream ] : NTFS - The Dark Side

The feature of NTFS from WinNT v3.1 onwards which is very dangerous as can be used to hide files on your system even undetected from several Antivirus, and other Security Products.

This ADS can even be used to hide malicious files, so to counter such covert attacks one need to figure out the the unwanted files in ADS on their disk drives.

To hide files in ADS (say adsF.ext into ADS of mainF.ext), at command prompt
cmd:\> type adsF.ext > mainF.ext:adsFile.ext
Now to access it (say it opens in Notepad)
cmd:\> notepad mainF.ext:adsFile.ext

For this several professional tools can be used, like
HijackThis (from Trend Micro) : http://free.antivirus.com/
Lads (from Heysoft) : http://www.heysoft.de/en/software/lads.php?lang=EN
SFind (in Forensic Toolkit) : http://www.foundstone.com/us/resources/

Here we discuss how to use ADS to hide files... and how to secure yourself from files in ADS.

To get a live demo Video on this stuff watch the video below:
http://blip.tv/file/2565748
or
http://www.youtube.com/watch?v=h96meoDYWSg