Tampilkan postingan dengan label Security News. Tampilkan semua postingan
Yesterday, we reported that Soneri Bank's Online Banking System official website (www.soneribankonline.com.pk) - The biggest banking network in Pakistan was Hacked and Defaced. Our security team decided to research the security hole exploited by the hackers.
After researching, we found that, Soneri Bank, The Biggest Banking Network of Pakistan is vulnerable to a very common exploit. Yes, WebDev IIS 6.0 vulnerability exists in the Soneri Bank Server with write permission on it. Details are below:
This article is completely educational purpose only. Author does not take any responsibility of any damage/harm to the site.
About WebDev Vulnerability:
WebDAV is enabled on Soneri Bank Server and it has write permissions enabled on it.The PUT HTTP Method can be used create a test file within this directory and to execute commands on the server. The PUT method is a part of the WebDAV standard for remote content editing.
A poorly configured Web server can mistakenly provide remote access to the PUT method without requiring any form of login. Even more.
How hacker managed to create a file on the server or execute code on the server? POC with picture and details are below:
We use HttpRequester Firefox Plugin to perform test. This tool is useful when doing web or REST development, or when you need to make HTTP requests that are not easily done via the browser (PUT/POST/DELETE).
We write the Test content: Test by The Hackers Post, appended test.htm and executed PUT method. We got the following response.
PUT http://soneribankonline.com.pk/test.htm
Content-Type: text/xml
Test By The Hackers Post
-- response --
201 Created
Date: Wed, 06 Mar 2013 07:26:29 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Location: http://soneribankonline.com.pk/test.htm
Content-Length: 0
Allow: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, COPY, MOVE, PROPFIND, PROPPATCH, SEARCH, LOCK, UNLOCK
Below is the ScreenShot of the response.
By visiting the URL,
This is how hacker manage to upload a html deface page on the server.
We try to upload a asp Shell on the server using PUT request but its refuse the request and response was 403 Forbidden. Below is the screen shot
The impact of this vulnerability
Malicious users can execute arbitrary code on this system. Possible system compromise.
How to fix this vulnerability
Remove write permissions from this directory or disable WebDAV if it's not being used.
I was shocked to see such a common and famous vulnerability exists in a Banking Software and allowed RCE (Remote Code Execution) and not properly configured. Questions arises, Where is Bank Security Team? Does the Bank have security Team? These are the questions still unanswered.
After researching, we found that, Soneri Bank, The Biggest Banking Network of Pakistan is vulnerable to a very common exploit. Yes, WebDev IIS 6.0 vulnerability exists in the Soneri Bank Server with write permission on it. Details are below:
This article is completely educational purpose only. Author does not take any responsibility of any damage/harm to the site.
About WebDev Vulnerability:
WebDAV is enabled on Soneri Bank Server and it has write permissions enabled on it.The PUT HTTP Method can be used create a test file within this directory and to execute commands on the server. The PUT method is a part of the WebDAV standard for remote content editing.
A poorly configured Web server can mistakenly provide remote access to the PUT method without requiring any form of login. Even more.
How hacker managed to create a file on the server or execute code on the server? POC with picture and details are below:
We use HttpRequester Firefox Plugin to perform test. This tool is useful when doing web or REST development, or when you need to make HTTP requests that are not easily done via the browser (PUT/POST/DELETE).
We write the Test content: Test by The Hackers Post, appended test.htm and executed PUT method. We got the following response.
PUT http://soneribankonline.com.pk/test.htm
Content-Type: text/xml
Test By The Hackers Post
-- response --
201 Created
Date: Wed, 06 Mar 2013 07:26:29 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Location: http://soneribankonline.com.pk/test.htm
Content-Length: 0
Allow: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, COPY, MOVE, PROPFIND, PROPPATCH, SEARCH, LOCK, UNLOCK
Below is the ScreenShot of the response.
By visiting the URL,
This is how hacker manage to upload a html deface page on the server.
We try to upload a asp Shell on the server using PUT request but its refuse the request and response was 403 Forbidden. Below is the screen shot
The impact of this vulnerability
Malicious users can execute arbitrary code on this system. Possible system compromise.
How to fix this vulnerability
Remove write permissions from this directory or disable WebDAV if it's not being used.
I was shocked to see such a common and famous vulnerability exists in a Banking Software and allowed RCE (Remote Code Execution) and not properly configured. Questions arises, Where is Bank Security Team? Does the Bank have security Team? These are the questions still unanswered.
Rating: 4.5
Reviewer: Unknown
ItemReviewed: How Soneri Online Banking System Website was hacked?
The official Twitter account of Jeep, the world-renowned brand of American automobiles, has been hacked on tuesday after Burger Kings account hijacking.
Yesterday, Burger King fell victim to a similar attack. At the time, the hacker tried to trick everyone into thinking that Burger King was sold to McDonalds.
It looks like big brands are not paying much attention to their social network properties.
After taking over Jeep�s account, the hacker posted messages such as
Shortly after recovering its account, Jeep posted the following tweet:
Similar to McDonald�s, Cadillac representatives clarified that the company �is not connected to the hack of the @Jeep Twitter account.�
However, there�s more to it than that.
Gizmodo has done some detective work and has found that the individual behind both the Jeep and the Burger King hacks is likely a DJ from New England called iThug. The DJ, Tony Cunha, apparently bragged on Facebook about his �accomplishments.�
In the meantime, Tony Cunha has deleted his Facebook account, which shows that Gizmodo might be right.
Yesterday, Burger King fell victim to a similar attack. At the time, the hacker tried to trick everyone into thinking that Burger King was sold to McDonalds.
It looks like big brands are not paying much attention to their social network properties.
After taking over Jeep�s account, the hacker posted messages such as
�You�ll never catch 50 Cent riding in dirty [expletive] Jeep!!!�
Shortly after recovering its account, Jeep posted the following tweet:
�Hacking: Definitely not a #Jeep thing. We�re back in the driver�s seat!�
Similar to McDonald�s, Cadillac representatives clarified that the company �is not connected to the hack of the @Jeep Twitter account.�
However, there�s more to it than that.
Gizmodo has done some detective work and has found that the individual behind both the Jeep and the Burger King hacks is likely a DJ from New England called iThug. The DJ, Tony Cunha, apparently bragged on Facebook about his �accomplishments.�
In the meantime, Tony Cunha has deleted his Facebook account, which shows that Gizmodo might be right.
Rating: 4.5
Reviewer: Unknown
ItemReviewed: Jeep Twitter account hacked after Burger Kings
The OWASP (Open Web Application Security Project) Top Ten is a list of the 10 most dangerous current Web application security flaws, along with effective methods of dealing with those flaws. The OWASP TOP 10 has been designed to raise awareness about crucial security threats faced by organisations. The data is based on 8 companies specialising in application security out of which 4 are consulting firms and the rest are tool vendors.
The OWASP (Open Web Application Security Project) is an organization that provides unbiased and practical, cost-effective information about computer and Internet applications. Project members include a variety of security experts from around the world who share their knowledge of vulnerabilities, threats, attacks and countermeasures.
The top 10 are selected on the basis of exploitability, detectability and impact estimate from over 500,000 vulnerabilities spanning over hundreds of organisations and thousands of applications. The purpose of which is to educate developers, designers, architects, managers and organisations regarding web application security weaknesses.
OWASP Top 10:
A1 � Injection:
Injection flaws, such as SQL, OS, and LDAP injection occur when untrusted data is sent to an interpreter as part of a command or query. The attacker�s hostile data can trick the interpreter into executing unintended commands or accessing unauthorized data.
A2 �Broken Authentication and Session Management:
Application functions related to authentication and session management are often not implemented correctly, allowing attackers to compromise passwords, keys, session tokens, or exploit other implementation flaws to assume other users� identities.
A3 � Cross-Site Scripting (XSS):
XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation or escaping. XSS allows attackers to execute scripts in the victim�s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.
A4 �Insecure Direct Object References:
A direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, or database key. Without an access control check or other protection, attackers can manipulate these references to access unauthorized data.
A5 � Security Misconfiguration:
Good security requires having a secure configuration defined and deployed for the application, frameworks, application server, web server, database server, and platform. All these settings should be defined, implemented, and maintained as many are not shipped with secure defaults. This includes keeping all software up to date.
A6 � Sensitive Data Exposure:
Many web applications do not properly protect sensitive data, such as credit cards, tax ids, and authentication credentials. Attackers may steal or modify such weakly protected data to conduct identity theft, credit card fraud, or other crimes. Sensitive data deserves extra protection such as encryption at rest or in transit, as well as special precautions when exchanged with the browser.
A7 � Missing Function Level Access Control :
Virtually all web applications verify function level access rights before making that functionality visible in the UI. However, applications need to perform the same access control checks on the server when each function is accessed. If requests are not verified, attackers will be able to forge requests in order to access unauthorized functionality.
A8 - Cross-Site Request Forgery (CSRF):
A CSRF attack forces a logged-on victim�s browser to send a forged HTTP request, including the victim�s session cookie and any other automatically included authentication information, to a vulnerable web application. This allows the attacker to force the victim�s browser to generate requests the vulnerable application thinks are legitimate requests from the victim.
A9 - Using Components with Known Vulnerabilities:
Vulnerable components, such as libraries, frameworks, and other software modules almost always run with full privilege. So, if exploited, they can cause serious data loss or server takeover. Applications using these vulnerable components may undermine their defenses and enable a range of possible attacks and impacts.
A10 �Unvalidated Redirects and Forwards:
Web applications frequently redirect and forward users to other pages and websites, and use untrusted data to determine the destination pages. Without proper validation, attackers can redirect victims to phishing or malware sites, or use forwards to access unauthorized pages.
The significance of the top 10 project is to understand what web applications can be prone to. OWASP provides additional information regarding these vulnerabilities that help the reader to prevent and combat such risks.
Download Complete Report:
The OWASP (Open Web Application Security Project) is an organization that provides unbiased and practical, cost-effective information about computer and Internet applications. Project members include a variety of security experts from around the world who share their knowledge of vulnerabilities, threats, attacks and countermeasures.
The top 10 are selected on the basis of exploitability, detectability and impact estimate from over 500,000 vulnerabilities spanning over hundreds of organisations and thousands of applications. The purpose of which is to educate developers, designers, architects, managers and organisations regarding web application security weaknesses.
OWASP Top 10:
A1 � Injection:
Injection flaws, such as SQL, OS, and LDAP injection occur when untrusted data is sent to an interpreter as part of a command or query. The attacker�s hostile data can trick the interpreter into executing unintended commands or accessing unauthorized data.
A2 �Broken Authentication and Session Management:
Application functions related to authentication and session management are often not implemented correctly, allowing attackers to compromise passwords, keys, session tokens, or exploit other implementation flaws to assume other users� identities.
A3 � Cross-Site Scripting (XSS):
XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation or escaping. XSS allows attackers to execute scripts in the victim�s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.
A4 �Insecure Direct Object References:
A direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, or database key. Without an access control check or other protection, attackers can manipulate these references to access unauthorized data.
A5 � Security Misconfiguration:
Good security requires having a secure configuration defined and deployed for the application, frameworks, application server, web server, database server, and platform. All these settings should be defined, implemented, and maintained as many are not shipped with secure defaults. This includes keeping all software up to date.
A6 � Sensitive Data Exposure:
Many web applications do not properly protect sensitive data, such as credit cards, tax ids, and authentication credentials. Attackers may steal or modify such weakly protected data to conduct identity theft, credit card fraud, or other crimes. Sensitive data deserves extra protection such as encryption at rest or in transit, as well as special precautions when exchanged with the browser.
A7 � Missing Function Level Access Control :
Virtually all web applications verify function level access rights before making that functionality visible in the UI. However, applications need to perform the same access control checks on the server when each function is accessed. If requests are not verified, attackers will be able to forge requests in order to access unauthorized functionality.
A8 - Cross-Site Request Forgery (CSRF):
A CSRF attack forces a logged-on victim�s browser to send a forged HTTP request, including the victim�s session cookie and any other automatically included authentication information, to a vulnerable web application. This allows the attacker to force the victim�s browser to generate requests the vulnerable application thinks are legitimate requests from the victim.
A9 - Using Components with Known Vulnerabilities:
Vulnerable components, such as libraries, frameworks, and other software modules almost always run with full privilege. So, if exploited, they can cause serious data loss or server takeover. Applications using these vulnerable components may undermine their defenses and enable a range of possible attacks and impacts.
A10 �Unvalidated Redirects and Forwards:
Web applications frequently redirect and forward users to other pages and websites, and use untrusted data to determine the destination pages. Without proper validation, attackers can redirect victims to phishing or malware sites, or use forwards to access unauthorized pages.
The significance of the top 10 project is to understand what web applications can be prone to. OWASP provides additional information regarding these vulnerabilities that help the reader to prevent and combat such risks.
Download Complete Report:
https://code.google.com/p/owasptop10
Rating: 4.5
Reviewer: Unknown
ItemReviewed: OWASP Top 10 2013 Application Security Risks Released
Facebook - a social networking giant with one billion active users said on Friday that it has been attacked by an unidentified group of hackers in January, fortunately no user information was compromised during the attack.
What is really interesting is the level of sophistication of the malware based attack that eluded security defense, it compromised the developer�s website and infected the employee's machine when visited it.
The laptops infected were fully-patched and running up-to-date anti-virus software occurrence that suggests attacker have exploited zero day vulnerabilities hosting an exploit on the web site.
The official statement reports:
�Facebook, like every significant internet service, is frequently targeted by those who want to disrupt or access our data and infrastructure. As such, we invest heavily in preventing, detecting, and responding to threats that target our infrastructure, and we never stop working to protect the people who use our service. The vast majority of the time, we are successful in preventing harm before it happens, and our security team works to quickly and effectively investigate and stop abuse.
Last month, Facebook Security discovered that our systems had been targeted in a sophisticated attack. This attack occurred when a handful of employees visited a mobile developer website that was compromised. The compromised website hosted an exploit which then allowed malware to be installed on these employee laptops. The laptops were fully-patched and running up-to-date anti-virus software. As soon as we discovered the presence of the malware, we remediated all infected machines, informed law enforcement, and began a significant investigation that continues to this day.�
Facebook confirmed no user data was compromised.
We have found no evidence that Facebook user data was compromised.
Facebook advisory confirmed that security teams of the company are very active in the fight to cyber threats thanks to an intense collaboration with law enforcement and security teams of other companies. The attacks seem to have exploited a zero-day Java software vulnerability well before the official announcement provided by Oracle company.
�After analyzing the compromised website where the attack originated, we found it was using a �zero-day� (previously unseen) exploit to bypass the Java sandbox (built-in protections) to install the malware. We immediately reported the exploit to Oracle, and they confirmed our findings and provided a patch on February 1, 2013, that addresses this vulnerability.�
The investigation are still ongoing as confirmed by Facebook
�We will continue to work with law enforcement and the other organizations and entities affected by this attack. It is in everyone�s interests for our industry to work together to prevent attacks such as these in the future.�
Facebook has a very managed bug bounty program which attracts Bug Bounty Hunter to participate in it and report vulnerabilities to facebook.
Rating: 4.5
Reviewer: Unknown
ItemReviewed: Facebook hacked by Java Zero Day exploit
The Energy Department has been under massive cyber-attacks, as a result information of its hundreds of employees has been stolen, the officials are not positive over theft of secret information, According to report.
The FBI is now investigating the attack in which hackers penetrated into 20 workstations and about 14 computer servers in the Washington based headquarters two weeks ago.
The Energy Department is now in contact with its employees who were hacked as a result of the cyber-attack and the account information has has been reset. The Department also said that this attack could be conducted from the Chinese capital of Beijing as the accuracy of attacks indicates the involvement of a foreign government.
The department includes the National Nuclear Security Administration, which maintains nuclear weapons.
The people�s republic of China is under a lot of pressure these days, as the WSJ and NYT has also accused the country of hacking its computers. Recently 250,000 Twitter accounts were also compromised in similar sophisticated cyber attack.
The FBI is now investigating the attack in which hackers penetrated into 20 workstations and about 14 computer servers in the Washington based headquarters two weeks ago.
The Energy Department is now in contact with its employees who were hacked as a result of the cyber-attack and the account information has has been reset. The Department also said that this attack could be conducted from the Chinese capital of Beijing as the accuracy of attacks indicates the involvement of a foreign government.
The department includes the National Nuclear Security Administration, which maintains nuclear weapons.
�It�s a continuing story of negligence,� former Energy Department security official Ed McCallum told the Free Beacon, explaining that the department continues to have security problems despite controlling some of the most �sophisticated military and intelligence technology the country owns.�The department also puts Iran in the line by saying that Iran and China both are after our secrets.
�China continues to develop its capabilities in the cyber arena,� the U.S. China Economic and Security Review Commission said in a November 2012 report to Congress. �U.S. industry and a range of government and military targets face repeated exploitation attempts by Chinese hackers as do international organizations and nongovernmental groups including Chinese dissident groups, activists, religious organizations, rights groups, and media institutions.�
The people�s republic of China is under a lot of pressure these days, as the WSJ and NYT has also accused the country of hacking its computers. Recently 250,000 Twitter accounts were also compromised in similar sophisticated cyber attack.
Rating: 4.5
Reviewer: Unknown
ItemReviewed: US Enegery department under Cyber Attack
Avast announced the launch of the company's new security bug bounty program, according to a recent post on avast. Avast will be offering bounties to security researchers for disclosing vulnerabilities in its products.
We at Avast take this very seriously. We know that being a market leader (Avast has more users than any other AV company in the world), we�re a very attractive target for the attackers. So, here�s our call to action: let�s unite and find and fix those bugs before the bad guys do!The rewards start at $200 (150 EUR), but they can be as high as $5,000 (3,750 EUR) for remote code execution vulnerabilities. In order to be eligible for the bounty, the bug must be original and previously unreported.
Bug Submissions are not accepted by avast from the following countries: Iran, Syria, Cuba, North Korea and Sudan.
Email address to report Bug:
bugs@avast.comSo start bug hunting...Good Luck !!
Rating: 4.5
Reviewer: Unknown
ItemReviewed: Avast announces Bug Bounty Program
Hackers have found yet another security flaw in Internet Explorer that would allow them to install malicious software on vulnerable computers.
Security company FireEye reports that the issue was discovered after the Council on Foreign Relations website got hacked, as the page was specifically compromised to exploit the flaw.
The attacks are made via Adobe Flash on a fully-patched computer running Internet Explorer 8, the security vendor said.
Rapid7 urged IE users to ditch the browser and rely on a rival's application.
"Since Microsoft has not released a patch for this vulnerability yet, users are strongly advised to switch to other browsers, such as [Google's] Chrome or [Mozilla's] Firefox, until a security update becomes available," Rapid7 advised in a Monday post to its Metasploit blog.
HD Moore, chief security officer at Rapid7 and creator of Metasploit, said he and his team had not yet tested IE10 on Windows 8. That testing is next on his to-do list. "But I would guess 'Yes,' that it can be exploited," Moore said in an interview today.
Microsoft has already confirmed that it�s investigating the issue, but has explained that IE9 and IE10 are not affected by the flaw.
�We are actively investigating reports of a small, targeted issue affecting Internet Explorer 6-8. We will take appropriate action to help keep customers protected once our analysis is complete. People using Internet Explorer 9-10 are not impacted,� Dustin Childs, group manager for response communications at Microsoft, told KrebsonSecurity.
Rating: 4.5
Reviewer: Unknown
ItemReviewed: Hackers Find Zero-Day Vulnerability in Internet Explorer
Windows 8 has already been attacked by hackers who wanted to activate the operating system at no cost, but there�s no doubt it�s one of the most secure Windows iterations released so far. according to post at softpedia.
Microsoft uses this argument to promote Windows 8 with every single occasion, while security companies across the globe confirm that it�s harder to attack the new OS.
McAfee said in its 2013 predictions report that Windows 8 may become hackers� next big target, but Rapid7 CISO and Metasploit founder HD Moore told eSecurityPlanet that exploiting the new platform could be a lot more difficult.
�The additional improvements in Windows 8 and the sky-high market for zero day may reduce the public visibility of security flaws to an all-time low,� Moore explained. �Microsoft still has work to do, but relative to other large software vendors, their ability to respond to security issues this year has improved.�
Rating: 4.5
Reviewer: Unknown
ItemReviewed: Windows 8 Will Be Harder to Hack � Security Expert Says
In the Name of Allah, the Benificent, the Merciful.
Hello World ..!!
Hello World ..!!
Rating: 4.5
Reviewer: Unknown
ItemReviewed: Hello World
