The WhiteHack Blog

I have noticed that I have not been including much in the way of security items within this blog, so lets kick off with a couple of cool new/updated toys.

First up we have GreenSQL, a database firewall.

(Original article here)

Any site that uses a database backend needs to be very aware of how easy a SQL injection attack is, just do a search on youtube and you’ll find loads (well, just under 800). For a good (and easy to read) book explaining how to protect against SQL injection (using PHP & MySQL 5) check out this book.

For those of you who want to take a belt-and-braces approach to your website back end security an interesting option is GreenSQL.

(continue reading…)

grsecurity’s Brad Spengler has just released details of an exploit that works on a fully patched Linux kernel (versions 2.6.30 and 2.6.30.1).

From TheRegister:

“The vulnerability is located in several parts of Linux, including one that implements functions known as net/tun. Although the code correctly checks to make sure the tun variable doesn’t point to NULL, the compiler removes the lines responsible for that inspection during optimization routines. The result: When the variable points to zero, the kernel tries to access forbidden pieces of memory, leading to a compromise of the box running the OS.”

The source code is rather interesting to read, indicating that due to gcc optimizations unexploitable code becomes exploitable, and it can bypass the mmap_min_addr in an SELinux vulnerability. The code can be compiled to work on 32bit and 64 bit systems.

YouTube video of exploit in action.

Awesome!

The elusive Anti-sec group struck again over the weekend, this time targeting Imageshack.

Again it’s using an undisclosed attack (keeping in line with their manifesto).

This time there is no denying that their attack was successful, anyone visiting Imageshack would have seen their message when trying to view any picture. Unlike the Astalavista hack they did not delete anything.
(continue reading…)

Rumours are rife about a new 0day SSH exploit for SSH.

Apparantly targetting version 4.3.0 of SSH, and made by the elusive anit-sec group, who are also resonsible for the takedown of Astalavista, the hack looks like this:
(continue reading…)

You may remember me writing about installing Windows 7 beta on a Samsung NC10 netbook.

Well, the latest version of BackTrack 4 has been released, so it seemed like a good idea to install that on there as well.

The NC10 has pretty large drive in it (160GB), so I cleared out some things and shrunk the D drive by about 35GB using Windows drive management, and created a space for the install.

(continue reading…)

I have been looking forward to this weekend for a number of reasons.
Firstly was the MCSE upgrade exam (to 2008), secondly we picked up the wedding rings, thirdly I was going to upgrade my iPhone software.

The exam went well, I passed with flying colours (that’s another three qualifications now!), the rings look lovelly, and I did not want to take mine off yesterday – well, I had to wear it a little bit didn’t I? And all the software needed to upgrade, jailbreak and unlock my iPhone.

I woke up early on saturday, and with about an hour and a half to spare decided to try and do the iPhone first.
(continue reading…)

Just encoutered a problem where an Acer Inspire One lost the wifi icon.

This seems to be a regular occurence with these netbooks, and most of the searching I did seemed to indicate a full system restore is required.

There is, however, a easy fix.

Open the Terminal program (you can do this by opening up a folder (such as Pictures), and selecting File > Terminal.

At the command prompt type in:

cd ~/.gconf/system/
Then type in
rm networking -r
You’ll need to press y a number of times to delete the folders.
When it returns to the command prompt type in
sudo init 6
The netbook will now reboot, and your wifi icon should be visible again.

Everyone knows that it takes only a couple of minutes for a machine on the internet without any form of protection to be compromised.

I learned this very quickly a few years back, we had just got broadband, courtesy of BT and one of those horrible looking blue and green “frog” boxes. I plugged it all in and even before getting to download my firewall and update my AV, my machine was riddled with viruses.

Thankfully out-of-the-box routers are more intelligent nowadays, they come with firewalls built in, and I am more tech savvy than to connect an unprotected machine to the interwebs.

But my interest in hacking has grown since then. I have achieved my Certified Ethical Hacker certification, and look to being more Security focused within my career.

So I decided, one wet Sunday morning, to have some fun and look at what happens to an unsecured machine.

(continue reading…)

If you get an email through Facebook like this:

XYZ sent you a message.

Subject: Hi

“Look at redbuddy dot be”

To reply to this message, follow the link below:

Its a phishing attack. Thankfully the graphics don’t come through, but don’t log in.
Registrant details are:

Domain Name redbuddy
Status REGISTERED
Registered May 21, 2009
Last update May 21, 2009 7:35 PM
Registrant Name: Petr Anisimov

The registrant address is in Russia.