Top 10 de vulnerabilidades en la Web.

Pasenado por la página de la OWASP me tope con ésto (ojo! es del 2007, calculo que en estos días se deberían publicar los del 2008), increíble, realmente es un análisis que debería sorprendernos y a la vez darnos el shock necesario para entender de una buena vez que hay hábitos a los cuales acostumbrarnos, medidas que esperan ser adoptadas y sobre todo una conciencia que después de ver ésto no deberá descansar tranquila :-)

Abajo les adjunto el listado:

A1 - Cross Site Scripting (XSS)	XSS flaws occur whenever an application takes user supplied data and sends it to a web browser without first validating or encoding that content. XSS allows attackers to execute script in the victim's browser which can hijack user sessions, deface web sites, possibly introduce worms, etc.
A2 - Injection Flaws	Injection flaws, particularly SQL injection, are common in web applications. Injection occurs when user-supplied data is sent to an interpreter as part of a command or query. The attacker's hostile data tricks the interpreter into executing unintended commands or changing data.
A3 - Malicious File Execution	Code vulnerable to remote file inclusion (RFI) allows attackers to include hostile code and data, resulting in devastating attacks, such as total server compromise. Malicious file execution attacks affect PHP, XML and any framework which accepts filenames or files from users.
A4 - Insecure Direct Object Reference	A direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, database record, or key, as a URL or form parameter. Attackers can manipulate those references to access other objects without authorization.
A5 - Cross Site Request Forgery (CSRF)	A CSRF attack forces a logged-on victim's browser to send a pre-authenticated request to a vulnerable web application, which then forces the victim's browser to perform a hostile action to the benefit of the attacker. CSRF can be as powerful as the web application that it attacks.
A6 - Information Leakage and Improper Error Handling	Applications can unintentionally leak information about their configuration, internal workings, or violate privacy through a variety of application problems. Attackers use this weakness to steal sensitive data, or conduct more serious attacks.
A7 - Broken Authentication and Session Management	Account credentials and session tokens are often not properly protected. Attackers compromise passwords, keys, or authentication tokens to assume other users' identities.
A8 - Insecure Cryptographic Storage	Web applications rarely use cryptographic functions properly to protect data and credentials. Attackers use weakly protected data to conduct identity theft and other crimes, such as credit card fraud.
A9 - Insecure Communications	Applications frequently fail to encrypt network traffic when it is necessary to protect sensitive communications.
A10 - Failure to Restrict URL Access	Frequently, an application only protects sensitive functionality by preventing the display of links or URLs to unauthorized users. Attackers can use this weakness to access and perform unauthorized operations by accessing those URLs directly.

Leer más...

Conceptos clave

Es de vital importancia tener conocimiento de algunos aspectos que se encuentran día a día en el área de la seguridad informática. Si trabajamos en ella no podemos desconocer los siguientes conceptos y todas las variantes e implicancias que poseen:

Attack
Vulnerabilities
Control
Threat Agent

Algunos links interesantes:

• Saltzer and Schroeder (see section 3)
• Saltzer and Schroeder Applied to Star Wars
• The Six Dumbest Ideas in Computer Security
• Gary McGraw's 10 steps to secure software
• OWASP Development Guide Project
• Engineering Principles for Information Technology Security (EP-ITS), by Gary Stoneburner, Clark Hayden, and Alexis, NIST Special Publication (SP) 800-27 (PDF)
• Secure Design Principles from "Foundations of Security: What Every Programmer Needs To Know" by Neil Daswani, Christoph Kern, and Anita Kesavan (ISBN 1590597842)
• High-Assurance Design by Cliff Berg, 2005, Addison-Wesley. Foreword by Peter G. Neumann. Design principles and patterns for secure and reliable design.

Leer más...

Nuevo Proyecto: OWASP

Desde hoy me he unido al proyecto Open Web Application Security Project (OWASP) - Argentina, estoy muy contento por ello y pondré todas mis fuerzas en el desarrollo de nuevos contenidos par atoda la comunidad. Pronto tendrán noticias.

Saludos, Leer más...

Distros de Linux relacionadas con SI

Clikéa en "Leer más" para ver la inmensa lista :-)

Security Distros

Here is the full list of Security Distros and their descriptions. Select the tool that best fits your needs.

BackTrack BackTrack is a distribution based off of what used to be WHAX and Auditor . It is a full size distro built off of SLAX. BackTrack Main Discuss Download Status: Active
Damn Vulnerable Linux ( DVL ) "Damn Vulnerable Linux (DVL) is a Linux-based tool for IT-Security. It was initiated for training tasks during university lessons by the IITAC (International Institute for Training, Assessment, and Certification) and S²e - Secure Software Engineering in cooperation with the French Reverse Engineering Team." - DamnVulnerableLinux.org Damn Vulnerable Linux ( DVL ) Main Discuss Download Status: Active
DEFT DEFT (acronym of "Digital Evidence & Forensic Toolkit) is a customized distribution of the Kubuntu live Linux CD. It is a very easy to use system that includes an excellent hardware detection and the best open source applications dedicated to incident response and computer forensics. -Deft.yourside.it DEFT Main Discuss Download Status: Active
FCCU The Gnu/Linux boot CD-Rom is made by the Belgian Federal Computer Crime Unit (FCCU) It's based on the KNOPPIX Live CD version 4.02 by Klaus Knopper. The main purpose of the CD : help the forensic analyze of computers All scripts made by the FCCU begin with the "fccu" prefix -lnx4n6.be FCCU Main Download Status: Active
Frenzy "Frenzy is a "portable system administrator toolkit," LiveCD based on FreeBSD. It generally contains software for hardware tests, file system check, security check and network setup and analysis. Size of ISO-image is 200 MBytes (3" CD)" -http://frenzy.org.ua/eng/ Frenzy Main Discuss Download Status: Active
grml "grml is a bootable CD (Live-CD) based on Knoppix and Debian. grml includes a collection of GNU/Linux software especially for users of texttools and system administrators. grml provides automatic hardware detection. You can use grml for example as a rescue system, for analyzing systems/networks or as a working environment." -http://grml.org/ grml Main Discuss Download Status: Active
Hakin9 "a bootable distribution containing all the tools and materials needed for practising methods and techniques described in the hackin9 magazine" -http://www.hakin9.org/en/index.php?page=hakin9_live- Hakin9 Main Discuss Download Status: Active
Helix "Helix is a customized distribution of the Knoppix Live Linux CD. Helix is more than just a bootable live CD. You can still boot into a customized Linux environment that includes customized linux kernels, excellent hardware detection and many applications dedicated to Incident Response and Forensics." -http://www.e-fense.com/helix/- Helix Main Discuss Download Status: Active
HeX HeX is a live security distribution that focuses on security monitoring and forensics. HeX Main Discuss Download Status: Active
KCPentrix " The Kcpentrix Project was founded in May 2005 , KCPentrix 1.0 was liveCD designed to be a standalone Penetration testing toolkit for pentesters, security analysts and System administrators" - KCPentrix.com KCPentrix Main Discuss Download Status: Active
Knoppix-NSM "knoppix-nsm is dedicated to providing a framework for individuals wanting to learn about Network Security Monitoring or who want to qucikly and reliably deploy NSM in their network. Our goal is to provide an introduction to NSM and a distribution that can be used as a launch pad to bigger things." -www.securixlive.com Knoppix-NSM Main Discuss Download Status: Active
Network Security Toolkit ( NST ) "This bootable ISO live CD is based on Fedora. The toolkit was designed to provide easy access to best-of-breed Open Source Network Security Applications and should run on most x86 platforms." -networksecuritytoolkit.org Network Security Toolkit ( NST ) Main Discuss Download Status: Active
nUbuntu "The main goal of nUbuntu is to create a distribution which is derived from the Ubuntu distribution, and add packages related to security testing, and remove unneeded packages, such as Gnome, Openoffice.org, and Evolution." - nubuntu.org nUbuntu Main Discuss Download Status: Active
Ophcrack "The ophcrack LiveCD contains a small linux system (SLAX6), ophcrackOphcrack.sourceforge.net Ophcrack Main Discuss Download Status: Active for linux and rainbow tables for alphanumerical passwords.The liveCD cracks passwords automatically, no installation necessary, no admin password necessary (as long as you can boot from CD). Windows Vista SAM can also be cracked." -
OWASP Labrat "The OWASP Live CD (LabRat) is a bootable CD akin to knoppix but dedicated to Application Security. It shall serve as a vehicle and distrubition medium for OWASP tools and guides." -OWASP.org OWASP Labrat Main Discuss Download Status: Active
Protech Protech is a specially designed Linux distribution for security technicians and programmers. It's imcomparable usability and stability makes this a unique product. -Techm4sters Protech Main Discuss Download Status: Active
Stagos FSE "Stagos FSE aims to be a computer forensic framework based on FLOSS operating system. Builds from Ubuntu, it has many feature to do forensics stuff. It supports read variant filesystem, include ntfs. It also support read some forensic imaging file from another forensic software such like ENCASE." -linuxforums.org Stagos FSE Main Download Status: Active
Arudius Arudius is a Linux live CD with tools that try to address the network security aspect (penetration testing and vulnerability analysis) of information assurance. It is based on Slackware (Zenwalk) for i386 systems and targets the information security audience. Arudius Main Discuss Download Status: Inactive
Auditor "The Auditor security collection is a Live-System based on KNOPPIX. With no installation whatsoever, the analysis platform is started directly from the CD-Rom and is fully accessible within minutes. Independent of the hardware in use, the Auditor security collection offers a standardised working environment, so that the build-up of know-how and remote support is made easier." - http://www.remote-exploit.org/index.php/Auditor_main- Auditor Main Discuss Download Status: Inactive
FIRE "FIRE is a portable bootable cdrom based distribution with the goal of providing an immediate environment to perform forensic analysis, incident response, data recovery, virus scanning and vulnerability assessment." -http://fire.dmzs.com- FIRE Main Discuss Download Status: Inactive
INSERT "INSERT is a complete, bootable linux system. It comes with a graphical user interface running the fluxbox window manager while still being sufficiently small to fit on a credit card-sized CD-ROM." -http://www.inside-security.de/insert_en.html- INSERT Main Discuss Download Status: Inactive
Knoppix-STD "STD is a Linux-based Security Tool. Actually, it is a collection of hundreds if not thousands of open source security tools. It's a Live Linux Distro, which means it runs from a bootable CD in memory without changing the native operating system of the host computer." - http://www.knoppix-std.org/- Knoppix-STD Main Discuss Download Status: Inactive
Local Area Security ( LAS ) Local Area Security ( LAS ) Main Discuss Download Status: Inactive
NavynOS "Navyn OS is a gnu/linux distribution based on Gentoo. Gentoo isn't a typical distribution like Debian or Slackware, it doesn't even have an installer, it is similar to making your own distribution. The main part of Gentoo is portage, a set of scripts for installing and removing programs." -http://navynos.linux.pl/ NavynOS Main Discuss Download Status: Inactive
Operator "Operator is a complete Linux (Debian) distribution that runs from a single bootable CD and runs entirely in RAM." - www.ussysadmin.com/operator/ Operator Main Discuss Download Status: Inactive
Pentoo "Pentoo is a penetration testing LiveCD distribution based on Gentoo. It features a lot of tools for auditing and testing a network, from scanning and discovering to exploiting vulnerabilities." -http://www.pentoo.ch/-PENTOO-.html- Pentoo Main Discuss Download Status: Inactive
PHLAK "PHLAK is a modular live security Linux distribution (a.k.a LiveCD). PHLAK comes with two light gui's (fluxbox and XFCE4), many security tools, and a spiral notebook full of security documentation. PHLAK is a derivative of Morphix, created by Alex de Landgraaf." - http://www.phlak.org/modules/news/- PHLAK Main Discuss Download Status: Inactive
PLAC "PLAC is a business card sized bootable cdrom running linux. It has network auditing, disk recovery, and forensic analysis tools. ISO will be avialable and scripts to roll you own cd." -http://sourceforge.net/projects/plac/- PLAC Main Discuss Download Status: Inactive
Plan-B "Plan-B is a bootable Linux environment without the need for a hard drive, it runs entirely in ram or from the cd, based on a basic, stripped installation of Red Hat Linux and the fundamental workings of the SuperRescue CD" -http://www.projectplanb.org/ Plan-B Main Discuss Download Status: Inactive
SENTINIX "SENTINIX is a GNU/Linux distribution designed for monitoring, intrusion detection, vulnerability assessment, statistics/graphing and anti-spam. It's completely free; free to use, free to modify and free to distribute. SENTINIX includes the following software, installed and pre-configured; Nagios, Nagat, Snort, SnortCenter, ACID, Cacti, RRDTool, Nessus, Postfix, MailScanner, SpamAssassin, openMosix, MySQL, Apache, PHP, Perl, Python and lots more." -http://sentinix.tigerteam.se/ SENTINIX Main Discuss Download Status: Inactive
SNARL snarl is a bootable forensics ISO based on FreeBSD and using @stake's autopsy and task as well as scmoo's list of known good checksums. -snarl.eecue.com SNARL Main Download Status: Inactive
Talos "Talos is a security LiveCD, based on SLAX 5.1.0 with over 90 security tools preinstalled. It runs directly from the CD without the need to install on the harddisk. Talos is currently on BETA version 0.1 and its available to download." -ISafe.gr Talos Main Discuss Download Status: Inactive
ThePacketMaster ThePacketMaster - Mission-Specific Live-CD Linux Distributions - thepacketmaster.com ThePacketMaster Main Discuss Download Status: Inactive
Trinux Minimal ramdisk linux distribution meant for network monitoring. Trinux Main Discuss Download Status: Inactive
WarLinux A linux distribution for WarDrivers. WarLinux Main Discuss Download Status: Inactive
WHAX Updated project from Whoppix. Currently discontinued and merged with BackTrack. WHAX Main Discuss Download Status: Inactive
Whoppix "Whoppix is a stand-alone penetration-testing live CD based on KNOPPIX. With the latest tools and exploits, it is a must for every penetration tester and security auditor. Whoppix includes several exploit archives, such as Securityfocus, Packetstorm, SecurityForest and Milw0rm, as well as a wide variety of updated security tools." -Distrowatch Whoppix Main Discuss Download Status: Inactive

Yo no junte toda esta info, mis agradecimientos a: http://inforleon.blogspot.com/ , por recopilarnos toda la data.

Saludos,
Leer más...

Helix3 Disponible.-

El nuevo Live CD de Helix,orientado al campo forense, desarrollado por e-fense ya esta disponible para descargar desde la su página web.
Este live CD basado en Ubuntu Linux, esta orientado a ser utilizado en escenarios donde no esta permitido la interacción con el equipo vulnerado, es muy sencillo de utilizar y brinda herramientas realmente útiles a la hora de realizar un análisis de la situación o un examen forense.
Realmente se los recomiendo.

Toda la información esta disponible en la web de e-fense.
De aquí pueden descargarse el manual.

Saludos,


aquí el texto escondido
Leer más...

Shellcoders - WTF ¿?

Seguramente muchos conozcan el término, pero realmente que es un Shellcode.
Wikipedia, como siempre tiene una respuesta, y es básicamente correcta. Un Shellcode es una seria _pequeña_ de instrucciones codificadas al mayoría de las veces íntegramente en código ASM que buscan la ejecución de shell mediante, por ej., el resultado de un buffer overflow (hablaremos de esto luego, lo debo aún).
Esto que aquí se enuncia puede parecer muy sencillo y básico y es por ello que resulta tan peligroso y explorado por tantos usuarios.
¿Para que nos sirve un Shellcode? o ¿Para que armaríamos uno?

Difícilmente querremos realizar esta labor para ejecutar un simple "/bin/sh" sino que gracias a la posibilidad de explotar diferentes recursos de la PC con estos códigos querremos hacer _algo_más_ que solo nosotros sabremos que es (y que puede ser lo que se nos de la gana ;) ). En este punto es donde el riesgo entra en juego, se pueden realizar códigos que utilicen las vulnerabilidades de diversos sistemas/aplicaciones para producir un buffer overflow (p. ej) y ejecutar de este modo código arbitrario. Eso es malo y es peor aún lo sencillo que es aprender a dominar este conocimiento con práctica.

Para que se vayan entrenando:
Shellcode.org
Y lo que lo trajo a mi memoria acá.
Leer más...

Contribuciones a LVS

Muchos de ustedes conocerán al famosísimo LVS, el cual nos ayuda básicamente a detectar cuales de nuestros server se encuentran activos y hacer load balancing entre ellos, si alguno cae es eliminado del servicio y no se tiene en cuenta, cuando levanta se incorpora nuevamente y forma parte de los servers activos.
Para la detección de estos cambios, los chequeos, las condiciones, etc. se utiliza un script diseñado en perl llamado ldirectord. Yo he trabajado mucho con este código y he llegado a realizarle modificaciones sustanciales para la incorporación de nuevas funcionalidades según las necesidades que han ido surgiendo, entre ellas cabe destacarse la inclusión de un chequeo del servicio SSH.
Les comparto acá el código de la función encargada de realizar el chequeo del servicio SSH y a la vez la inclusión/exclusión del sistema de balanceo que proporciona el LVS (este código deben incluirlo en el ldirectord y deben algun argumento y asociarlo a esta nueva funcionalidad):

sub check_ssh {

use IO::Socket;
use IO::Select;
my ($v, $r) = @_;
my $sock;
my $s;
my $buf;
my $port=(defined $$v{checkport}?$$v{checkport}:$$r{port});
my $status = 1;

&ld_debug(2, "Checking ssh server=$$r{server} port=$port");

unless ($sock = new IO::Socket::INET(PeerAddr=>$$r{server},PeerPort=>$port,Proto=>'tcp') ){
service_set($v, $r, "down");
return 1;
}

if($sock)
{
service_set($v, $r, "up");
$status = 0;
}
else
{
service_set($v, $r, "down");
}

$s = IO::Select->new();
$s->add($sock);
$s->remove($sock);
$sock->close;


return $status;
}


Oficialmente formo parte de la lista de distribución del proyecto LVS y obviamente continuaré contribuyendo al desarrollo de esta y de muchas más aplicaciones opensource.

Saludos, Leer más...

Estamos en la semana internacional de la seguridad informática!

En el año 1988, la Association for Computing Machinery (ACM) declaró al 30 de Noviembre como el “Día Internacional de la Seguridad Informática”, con el objetivo de concientizar respecto de las amenazas que atentan contra la seguridad de la información.
En este año, durante la semana del 24 de noviembre al 1º de diciembre, se convoca a las Instituciones a participar realizando conferencias, jornadas o cualquier otra acción concientizadora relacionada con la seguridad Informática.

La Universidad Nacional de La Plata (UNLP) a través del Centro Superior para el Procesamiento de la Información (CESPI), participará activamente en este marco realizando charlas abiertas a la comunidad durante la semana mencionada.

Más info acá. Leer más...

Solución al CRACKME de Hispasec.-

Enhorabuena, ya están los ganadores del "crackme" que propuso hispasec en festejo de su decimo aniversario. La verdad que es un problema muy interesante que les recomiendo a todos que intenten resolver por su cuenta, les dejo el link para que se descarguen el archivo y también otro link para que observen la mágnifica solucion que dejo el Sr. Alejo Murillo (primero intenten ustedes ;) ).

Decargar CRACKME
Ver solución

Saludos y disfruten! Leer más...

¿WPA y WPA2 inseguros? No confundamos las cosas.

El pasado 10 de noviembre, dos investigadores alemanes (Erik Tews y Martin Beck) alegaron haber saltado las restricciones de WPA. Sus intentos fueron ciertos y es por ello que comenzó el debate nuevamente sobre la seguridad en las WLANs.
WPA/WPA2 es un sistema de protección que se aplica a redes wireless, surgió como mejora a WEP el cual era y es inseguro.
Al definir a WPA como sistema hay que tener en cuenta que por ello los métodos de seguridad que emplee están fuera de él, es decir WPA/WPA2 puede utilizar diversos algoritmos para garantizar la seguridad de los datos.
Es hora de preguntarnos ¿Se quebranto al seguridad en el sistema que creíamos más seguro en la actualidad?
No, solamente se encontró la forma de deshacerse de las restricciones que se obtienen con la incorporación de protección WPA/WPA2 con TKIP.

TKIP es, como su nombre lo indica, un protocolo de integridad de clave temporal. Suele utilizarse en la mayoria de las redes wireless protegidas con WPA. La falla que se hallo vulnera directamente el metodo que utiliza TKIP para la encripcion de paquetes. Entra en juego ahora otro cuestionamiento más ¿Cual es la profundidad de este ataque?
En principio lo que este tipo de ataques permite es la desencripcion de algunos pquetes en la red y la posibilidad de hacer injection. Este ataque no permite la recuperacion de la contraseña y esta limitado a una pequeña cantidad de paquetes a injectar.

Sin embargo este descubrimiento a alertado a todos los especialistas del area y diversas herramientas estan readapatandose para explotar al maximo la nueva vulnerabilidad. El ataque chopchop en principio ya podría ser utilizado.

¿Que acciones tomar?
Simple, migrar a WPA2 con cifrado AES.

Links de interes:

• Aircrack pappers
• Breaking WEP and WPA
• ChopChop Attack
  

Leer más...