Can ClickOnce become a security hazard?

ClickOnce is a latest deployment technology that comes with Microsoft Visual Studio.NET 2005. With ClickOnce, deploying Windows Forms solutions becomes almost as easy as Web based solutions. In a certain way, it represents a sort of hybrid between ActiveX and the standard .EXE files. We picked up a free beta disk from HITB and asked ourselves the immediate question of whether ClickOnce could pose some sort of security risk. These are our findings.

As ClickOnce is a new release with Visual Studio.NET 2005, we were all very excited to try out this new deployment mechanism, which could mean the return to favour of Windows Forms applications. There are some obvious advantages programming in Windows Forms, one of the most distinct being how much easier it is to work with the standard datagrid and Crystal Reports. We were also concerned about whether ClickOnce could be abused like certain ActiveX controls.

For detailed explanations on ClickOnce technology, here are some very useful links.

MSDN TV: ClickOnce
http://msdn.microsoft.com/msdntv/episode.aspx?xml=episodes/en/20040108ClickOnceJC/manifest.xml

Security and server configuration issues on ClickOnce
http://msdn2.microsoft.com/en-us/library/ms228998.aspx
http://msdn2.microsoft.com/en-us/library/ms228996(en-US,VS.80).aspx
http://msdn2.microsoft.com/en-us/library/76e4d2xw.aspx

We will not be repeating any material from these excellent sources, other than to say that ClickOnce allows easy web or network based deployment of Windows Forms applications. It also enables these applications to automatically check for updates and update themselves when necessary. Such features used to cost money and programming effort. Now, they come free with Visual Studio.

In this article, we used the default behaviour of ClickOnce.

One of the most obvious attacks would be a variation of a phishing attack. For example, an email that reads like this:

From support@some.reputable.company.com :

Dear user, this is a critical update for your system. It addresses [some dummy issue]. Please install the update immediately:

[Malicious, disguised link here]

The link above, in true phishing style, could lead users to some malicious website, where a malicious ClickOnce application is waiting for them. Anyone with a copy of Visual Studio.NET could create something potentially dangerous.

ClickOnce, to its credit, does offer some form of protection, and will ask for permissions to install. This is what you may see on a system that doesn not have .NET Framework 2.0 installed.

And subsequently, the relevant files are downloaded and executed. The user does have a chance to stop the execution of these files.

This prompt will NOT appear on systems with .NET 2.0 installed.

And one last chance offered to the user. That makes a total of 2 checks to get past in order for any malicious software to be installed. For systems with .NET 2.0 already installed, the screens you will see are slightly different. We wrote a small console application to test the features of ClickOnce.

The From: field advertised in this dialog box can easily be modified in Visual Studio.NET 2005. For example, a malicious attacker could try masquerading his application as a product of some reputable company. A very determined attacker could also buy a certificate from a reputable source, which would make his malicious application look even more genuine.

We programmed our tiny application to attempt to add a key to HKLM\SOFTWARE\Microsoft\CurrentVersion\Run, and it was a success. The application pauses to allow us to check our registry, afterwhich, it removes the entry. Really malicious attackers will probably get more creative than this.

So it appears that although we didn't get ClickOnce to do anything it wasn't supposed to do, the application it installed could contain some malicious code. Perhaps, it would be useful to have any application installed by ClickOnce inherit the same kind of restrictions. Although there are security mechanisms provided in the framework, we suspect a more likely scenario would be that of users falling prey to malicious applications posing as legitimate ClickOnce deployments, in a similar style to various known phishing attacks, fake SSL certificates, and other modern day trickery. The general lack of awareness that is common to all these problems will probably surface again. Users do, get at least one chance to prevent a potentially malicious application from installing. A good imitation of a respectable source might also fool some users, such as this fake one we made.

More safety measures:

Application developers who wish to use ClickOnce can also consider using Authenticode and Code signing as shown in this MSDN article:

http://msdn2.microsoft.com/en-us/library/ms172240.aspx

Again, we wish to reiterate that valid certificates don't always prove that an application publisher has benign intent. A malicious attacker can also purchase certificates from a recognized and reputable vendor.

Conclusion:

The ClickOnce mechanism appears to be well designed, with suitable digital signing features available, and certainly makes deployment of Windows Forms applications a lot easier than before. There are warning signs when the ClickOnce application requests for higher priviledges than it should have. The user however, is still able to choose to accept or to reject the installation of an application, sometimes with little idea of how safe the code is. It appears possible that if ClickOnce becomes popular, and people get too used to seeing the security prompt and just allowing the install anyway, then we might start seeing more malicious payloads being distributed via ClickOnce technology, while masquerading as legitimate or benign applications.

For home users, just remember to distrust applications as you would all other known phishing scams. Distrust emails and their contents, from everyone, especially unsolicited ones from people you do not know well. Do not install applications without first finding out more about what they do, and if anyone has a bad remark about them. There is no need for paranoia but stay on alert for anything that looks suspiscious

A related article we found:

A Security Hole in ClickOnce Deployment.
http://www.rollthunder.com/Newsletter/newslv7n1.htm#Feature%20Article

Keyloggers and Virtual keyboards

Keyboard loggers are reasonably well known menaces today. Although there is arguably a legitimate usage for them, they are often used for malicious purposes, such as stealing passwords and other naughty activities. In Singapore, onscreen keyboards have started appearing on important applications and installations in an attempt to counter the threat of keyloggers. How much protection do these virtual keyboards offer to the users? In this article, we take a look at virtual, or onscreen keyboards, and how good they really are.

Generally speaking, a keylogger is a piece of hardware or software that captures the keystrokes typed at the keyboard. They can be dumb, capturing everything, or smart, to the extent that they can distinguish passwords and login credentials as users type them at the keyboard. Today, common advice is to use the onscreen keyboard to defeat keyloggers. Windows XP comes with a built in onscreen keyboard, where characters are clicked onscreen, rather than typed.


An interesting exchange can be found on this forum http://www.habbos.co.uk/viewtopic.php?id=3705

An excerpt here:
Premium: But can the a keylogger trace the On Screen Keybored?
Clarkylfc: Jord it cannot trace it - a keylogger is a program which records the entered keys! The on screen keyboard is a program and thekeylogger doesnt record programs

This blog entry says that Virtual (Onscreen) keyboards protect against keyloggers and spyware: http://pchere.blogspot.com/2005/07/virtual-keyboards-protect-against.html

An excerpt here:
I enter the usernames and passwords using this keyboard and even if there are any spyware logging keystrokes, they will not get hold of my private information. Why? because you will enter this information by mouse clicks and not keystrokes.

This commentary about online banking on Citibank India suggests that the new login procedure is SAFER. http://www.guide2net.net/mobile_internet/product_reviews/vipul/on-line_banking/index050414.html

An excerpt here:
Now about safety part, start using banks which think of all this thru before you have to worry. In India awareness among foreign bank about password based hacking is high. Citibank recently changed the way we logon to their website to access our accounts. By default it doesn't accept our keyboard input so there is no question of key logger trapping our keystrokes. Citibank uses onscreen keyboard which you use with your mouse, configuration of numeric keys on onscreen keyboard is random and changes every time for additional safeguards. Unlike keyboard strokes, mouse movement/clicks are extremely difficult to track for hacking purposes and that makes it very safer alternative.

In Singapore, not all banks use onscreen keyboards for logins. Some do, and others use hardware tokens in conjunction with login credentials. Some improve on the onscreen keyboard concept by having their keys change positions randomly every time the user accesses the login page. So is this really safe and have these writers we’ve just seen gotten it right? Well sadly the correct answer is NO.

Virtual or onscreen keyboards, randomized or not, are no safer than physical keyboards. While there are no equivalents of hardware devices for physical keyboards, a correctly placed video camera would do the trick. But what about software solutions? How can anyone make sense of mouse clicks? Well, with a little intelligence, a hacker can use your mouse clicks, to reveal what you are “typing” into onscreen keyboards. In August 2005, a proof of concept attack was posted, showing how to overcome Citibank’s virtual keyboard (http://www.hackinthebox.org/modules.php?op=modload&name=News&file=article&sid=17684) .

This attack is in a sense limited in scope, as it is targetted for a specific application. Citibank websites in different countries around the world employ differing mechanisms anyway.
For more generic purposes, new generation keyloggers no longer just capture keystrokes. They also capture mouse clicks. You may be thinking how on earth mouse clicks can reveal what you are “typing”. In actual fact, the clicks are not the key. What actually happens is that whenever you click, the keylogger captures a tiny portion of the screen where your mouse cursor is. This can vary from a 10x10 square, to whatever dimensions a hacker specifies. In other words, the hacker is able to “see” whatever you “type”, regardless of where it is on the screen. In other words, virtual/onscreen keyboards are useless in terms of safeguarding your privacy.

Generally speaking, safe practices that could help protect you include:

• never doing internet banking on a public computer, whether this is a computer at a cyber café, or a common desktop in the office
• try not to log in, to anything at all, from public computers. That includes email, online forums and such
• try not to log in, to anything at all, from somebody else’s computer. even if that person is trusted, his computer is not.

MAC Hack on Linux

A video says more than a thousand words. We had made this short clip to show you how it would have been done using Linux to hack the MAC address. The ease of which this can be accomplished should show you that MACs are unreliable for any audit trails, or authentication purposes.
See the video here :

Cerberus Network visits IDG SecurityWorld Conference and Showcase

Cerberus Network just returned from the 1 day conference held by IDG World Expo and sponsored by many big names such as Mcafee, Symantec and Juniper.

The conference was held at Grand Hyatt Hotel Singapore on 28 Oct 2005. The key events were the presentation by many outstanding speakers and the showcase of products by the various vendors and sponsors of the events.

The key presentations covered strategies and risk management concepts in the security field. Various statistics of hacking, virus attacks, and vulnerability reports collected from various sources were displayed by the speakers. The factors that affect security implementation, as well as the percentage of adoption and allocation of resources for security according to studies of many companies were also discussed. The Unified Threat Management approach for hardware defense were also introduced, against the context of the conventional network firewall we have today.















The showcase consisted of 2 sections and vendors such as Mcafee, Symantec, Juniper, Verisign and CipherTrust were all out in full force displaying their latest products and technology. One interesting product we found was the IronMail from CipherTrust that actually has the ability to counter phishing, which is rare if not unique among hardware firewalls. The WatchGuard Firebox series was also outstanding with the bright red colored boxes which ranges in both functions and cost. Sophos was there to promote their antivirus software products and were giving away free trial versions, as well as a booklet which we find very informative and suitable general consumption.
Here are some souvenirs you might be able to find at the booth. We missed a few here and there, but this is pretty much all of it.

















In addition there were complimentary back issues of CIO and ComputerWorld. The event ended with the panels of speakers answering a few questions from the public, and then giving away of the various grand prizes including some Mini combo CD players, Nokia N90, Coolpix S1 and other great gifts.

MAC Hack in Windows

It is well known nowadays that MAC filters come with firewalls and routers, including virtually all commercial off the shelf products. MAC Ids are based on the assumption that MAC is unique and tagged to each piece of network equipment. Although it has been known for a long time now, consumers still tend to believe the urban legend that MAC Id protection is an effective way to protect their wireless networks. This article shows how we cloned a MAC address in windows and bypassed the firewall protection using MAC Filter. Nothing new to the experts obviously, but maybe something important for the consumer.

(This entire experiment was conducted in a controlled environment in our laboratories. No networks were attacked or entered, that didn't belong to Cerberus Network).
This article is not going to introduce what a MAC is. There are lots of wonderful articles outside that explains what a MAC is. However, along the way, there are some typical assumptions people make about the MAC:

1. It is unique and cannot be forged / faked.

2. MAC Filter will prevent anyone else from entering the network without the physical authorized hardware.

3. MAC address is linked with the manufacturer and can be traced.

In fact, based on point 2, we have even encountered enterprise wifi setup without WEP or WPA at all, but with ONLY MAC Filter on. And yet at another setup, there wasn't even a proper admin password setup because somebody thought that without an approved card, that is allowed to access the network, others can't even get into the network in the first place. Well, we are about to find out.

First, we have a simple setup on a router that allows a wired connection with a known MAC from a authorized equipment.



This network which we are about to get in is known as "Hacked". We should just verify with our Wifi card, which has a different MAC Address from the wired authorized equipment, and indeed we cannot enter the network.




OK, we are kicked out mercilessly. So we use software, which is really easily available and not particularly expensive, to change the MAC address of our Wifi card to the address of the known Wired equipment.
We restart the network and attempt to connect to 'Hacked' and ... we're in.





Just to be sure we did not by mistake allow our Wifi card in because of a misconfiguration, we checked the router settings.



With the proper equipment, attackers can easily tell what MAC Ids are connecting to your access point because MAC Ids are always transmitted in plaintext, regardless of whether or not WEP/WPA is employed. As such, this shows that it is not very difficult to hijack a network connection or even install a rouge AP into a wireless network that is not properly protected.

We're not saying that using the MAC Filter is totally useless and you should not enable it. What we are saying is that it should not be your ONLY line of defense. And remember MAC Filters only give you perhaps, a few minutes worth of protection. Although masquerading another MAC could cause the legitimate network connection to drop, thereby triggering an alarm, a good attacker would probably gather the correct MAC addresses to use, and only try his intrusion attempt when the legitimate computer or client is not connected. Neither can MAC address logs be of any use because an attacker would very likely fake a MAC address to cover his tracks. Hence, wireless networks should never rely on MAC address to perform authentication, audit, or similar functions.

Stay tuned for more security articles here.

Recovering the Linksys WRT54G

Many people have probably tried modifying the Linksys WRT54G to turn it into a something else rather than the Linksys router (*ahem*) ;-). Perhaps, yours is just dead due to a bad flashing process. Due to the way firmware is transfered via TFTP, and sometimes simple due to bad firmware, there is a reasonable chance someone will end up with a brick instead of whatever it was suppose to be. We almost lost our beloved WRT54G but thank goodness we managed to bring it back from the dead. So we want to share our near death experience with you.
Disclaimer: We take no responsibility for any damage you may do to your router, directly or indirectly as a result of following what we've outlined here. We also take no responsibility for what you may do with your router if you do manage to save its soul. Do not engage in illegal acts with your router.
Ok, lets get on with it.

Many people have probably ignored the set BOOTWAIT=ON instruction because they didn't think the firmware would fail in the first place. Well, if that was done in the first place, it will come in very handy in situation like this. When the firmware fails, the WRT54G still allows you to flash the firmware at boot time. The router will not need to be taken apart and no shorting of circuit will be required. In fact, you can safely skip the next few paragraphs to where we get on with flashing the unit.

If you're reading this, perhaps you're one of those who have not heeded the warning to set BOOTWAIT=ON . Welcome to the hard part. Firstly, you will need some tools before you begin. You will need a very small screwdriver or metallic point capable of conducting electricity. In addition, you will need a magnifying lens, microscope or in our case, just one side of a pair of binoculars.

Next you will need to turn the screws and remove the 2 antenna behind. For those who have modified or replace antenna before, this would be the same procedure. Its fairly simple, just unscrew.

Now get ready to void your warranty. You will need to remove the Blue cover plate. Hold the router firmly then press, and pull out. You will quite likely break the warranty sticker in the process. This is how things look after removing the blue cover plate.

Now you need to put the blue cover plate aside and open up the rest of the box. The whole black plastic casing can be removed as shown in the next picture.

You will need to identify the back part of the circuit board. Namely, you need to know which is the reset button, the 4 UTP connectors and the power plug.

There is one more thing you need to identify and its on the circuit board. Thats the Intel firmware chip. For the version we tested on, the pins to short are 15 and 16. Other versions may require shorting different pins. There is where you need the magnifying lens.

And if you had BOOTWAIT=ON, this is where you will come in and join the rest of the article.
Before you short the pins, you will need to start your laptop or PC and connect a UTP LAN cable to your router via one of the 4 ports. You will need to open up 2 console windows, one of them running TFTP. The other window running ping. You can do this in Windows or Linux but the specific commands may vary. We used Linux in our test and we set ping to go on for a very long time with ping -n 9999 192.168.1.1. As for TFTP, you will need to at least have the following commands ready:

TFTP 192.168.1.1

>binary

>rexmt 1

>put ( Do not press [Enter] yet )

If you had BOOTWAIT=ON set, all you need to do is to power up your router. Once you see that the ping works, press [Enter].

If not, this is the tricky part. There are reports that you can get the firmware chip to go into failsafe mode by shorting the circuit and plugging in the power. We did not manage to get that to work. However, what we did was much more dangerous. We powered up the router, used the magnifying glass, and inserted the screwdriver between pins 15 and 16. Lightly twist it so that it touches and shorts the 2 pins. The ping will take a few more seconds to kick in, get ready to press [Enter].

Some may lose the process here and not know what to expect on the TFTP side. So did we. If your TFTP console is not saying anything about ACK accepted, it did not work. If it says that but is too slow to complete the transfer, you have probably forgotten to set rexmt 1. What you should see is ACK accepted and lots of transfers in a short time. It takes only a few seconds to complete. If you get that going, congratulations. You can press the reset button on the router now.

Why do I need the ping? You need it to know when failsafe mode is on. And you need it to trigger the transfer on TFTP. Another question will probably be what firmware to flash. Our suggestion is that during the rescue, you should use the original Linksys firmware. After you have successfully saved your router, you can flash it with anything else you like. However, do remember to set BOOTWAIT=ON this time if you had not done so previously.

I hope this article will help somebody recover his router. Over here in Singapore, this router is easily available and cheap, but its still an expensive brick if you can't save it from a bad flash.
If you have any comments, feel free to reach us by email.

Winston
Reference : http://voidmain.is-a-geek.net/redhat/wrt54g_revival.html

Is your NRIC safe? Part 1/2

The Singapore NRIC In Singapore, the NRIC is an individual identifier. Similar to the Social Security number in America, the NRIC identifies each individual uniquely. The Singapore Government has an online password system called SingPass (http://www.ecitizen.gov.sg/singpass/index.htm) that is used in a variety of online services for citizens. Examples include Singapore’s CPF system, and the Accounting and Corporate Regulatory Authority, which governs business operations in Singapore. The NRIC is also a common token used by banks, telcos, and various other service providers to authenticate their users over the phone. In this article, Cerberus Network looks at the NRIC and some of the potential for mischief and fraud associated with this identifier.

NRIC stands for National Registration Identity Card. The NRIC Number (UIN), or NRIC in short, consists of 9 digits. The first digit is S, T, F or G, following by 7 numeric digits, and an alphabet that serves as a check digit. Ngiam Shih Tung (http://www.ngiam.net/NRIC/) has a very concise and detailed writeup on the Singapore NRIC checksum algorithm. He has also actively questioned the National Library Board of Singapore on their policy of allowing users to check borrowing records simply with a surname and an NRIC. Chue Wai Lian also wrote an NRIC checker for DOS/Win32 and Java (http://web.singnet.com.sg/~wailian/nric.htm).

As the NRIC uniquely identifies a person, can its exposure lead to identity theft and fraud? This is an important question that Cerberus Network would like to answer. In addition, what is the most current status on the algorithm used to compute the NRIC checksum? Although there are no known public documents from the authorities, there are references from Ngiam Shih Tung and Mac-Net.com (http://www.mac-net.com/183580.page), that this algorithm could be available from the Ministry of Home Affairs/ICA department, for a fee of $200-400. However, links offered by both sources seem to have been outdated.

With hardly any official confirmation or denial of publicly floating NRIC algorithms, Cerberus Network has studied the NRIC check digit problem and we agree completely with Ngiam Shih Tung on his findings. We have also designed a free web service that can be used to decide NRIC check digits, implementing an algorithm based on Ngiam Shih Tung’s publication (http://www.ngiam.net/NRIC/). If you know how to consume a web service, the URL is http://www.cerberus-network.com/NRIC.asmx . The web service is provided as is. Cerberus Network provides no warranties, express or implied, and does not guarantee the accuracy of the results whatsoever. The web service is also provided for legal and legitimate, or research usage only.

In a typical context, the NRIC is usually used with a person's birthdate, and sometimes the maiden name or surname of his mother, to establish authentication. This is a common procedure in a bank, and also with telcos. For operations that require tighter security, banks typically ask questions like "How many accounts do you have with us?", "How many cards do you hold?" or "What is your credit limit?". However, with the NRIC always being one of the key questions asked, we need to pause and consider if it could one day become the favourite identify theft instrument of malicious parties.

Security

So exactly how safe is the NRIC? Could it become an instrument of identity theft or fraud? We will discuss this in the next installment.

Is your NRIC safe? Part 1/2

The Singapore NRIC In Singapore, the NRIC is an individual identifier. Similar to the Social Security number in America, the NRIC identifies each individual uniquely. The Singapore Government has an online password system called SingPass (http://www.ecitizen.gov.sg/singpass/index.htm) that is used in a variety of online services for citizens. Examples include Singapore’s CPF system, and the Accounting and Corporate Regulatory Authority, which governs business operations in Singapore. The NRIC is also a common token used by banks, telcos, and various other service providers to authenticate their users over the phone. In this article, Cerberus Network looks at the NRIC and some of the potential for mischief and fraud associated with this identifier.

NRIC stands for National Registration Identity Card. The NRIC Number (UIN), or NRIC in short, consists of 9 digits. The first digit is S, T, F or G, following by 7 numeric digits, and an alphabet that serves as a check digit. Ngiam Shih Tung (http://www.ngiam.net/NRIC/) has a very concise and detailed writeup on the Singapore NRIC checksum algorithm. He has also actively questioned the National Library Board of Singapore on their policy of allowing users to check borrowing records simply with a surname and an NRIC. Chue Wai Lian also wrote an NRIC checker for DOS/Win32 and Java (http://web.singnet.com.sg/~wailian/nric.htm).

As the NRIC uniquely identifies a person, can its exposure lead to identity theft and fraud? This is an important question that Cerberus Network would like to answer. In addition, what is the most current status on the algorithm used to compute the NRIC checksum? Although there are no known public documents from the authorities, there are references from Ngiam Shih Tung and Mac-Net.com (http://www.mac-net.com/183580.page), that this algorithm could be available from the Ministry of Home Affairs/ICA department, for a fee of $200-400. However, links offered by both sources seem to have been outdated.

With hardly any official confirmation or denial of publicly floating NRIC algorithms, Cerberus Network has studied the NRIC check digit problem and we agree completely with Ngiam Shih Tung on his findings. We have also designed a free web service that can be used to decide NRIC check digits, implementing an algorithm based on Ngiam Shih Tung’s publication (http://www.ngiam.net/NRIC/). If you know how to consume a web service, the URL is http://www.cerberus-network.com/NRIC.asmx . The web service is provided as is. Cerberus Network provides no warranties, express or implied, and does not guarantee the accuracy of the results whatsoever. The web service is also provided for legal and legitimate, or research usage only.

In a typical context, the NRIC is usually used with a person's birthdate, and sometimes the maiden name or surname of his mother, to establish authentication. This is a common procedure in a bank, and also with telcos. For operations that require tighter security, banks typically ask questions like "How many accounts do you have with us?", "How many cards do you hold?" or "What is your credit limit?". However, with the NRIC always being one of the key questions asked, we need to pause and consider if it could one day become the favourite identify theft instrument of malicious parties.

Security

So exactly how safe is the NRIC? Could it become an instrument of identity theft or fraud? We will discuss this in the next installment.

Cerberus Network visits HITB 2005

We've returned from HITB 2005, Westin KL, Malaysia. It was a fruitful and informative trip, certainly well worth the 4 hour drive up from Singapore, and here are some of the highlights of the conference.

The Hack In the Box conference was held at Westin, KL. This year, some of the key highlights were the Open Hack contest, and various other live demonstrations by the speakers. Microsoft was the main sponsor for the event, and naturally, launched the event with a preview of Windows Vista. We really enjoyed the event and here are the best snippets.

A counter example of good physical security practice. This one was at the hotel we stayed at. In fact, the hotel wasn't the only culprit. We've seen this setup often enough. The power supply was in fact within reach of an outstretched arm. Certainly easy to disarm this camera.

Windows Vista

Microsoft's new line of Operating System, which should replace the Windows XP line when it launches. During the keynote address, the date touted was mid 2006. We look eagerly forward to having our own copy next Christmas then. That makes a pretty interesting year ahead, with Visual Studio 2005 and SQL Server 2005 this Christmas season.

Vista is also supposed to incorparate many new security features, including the ability to surf in protected mode. In this mode, Internet Explorer will operate in a manner that will refuse to execute the usual security breach suspects - ActiveX and BHO. Anti-Phishing was also the call of the new OS, which connects to a Microsoft databased that identifies known phishing sites. Users who encounter suspicious sites can also choose to report them to Microsoft. According to the Microsoft representatives, Microsoft will have their human investigators in action to verify if the reported site is indeed malicious. Once verified malicious, the site will be added to the online database, thereby helping other users.

With many other security oriented features and a wonderfully beautiful GUI, we were truly salivating all over our conference seats.

Social Engineering

The best hacks often occur before hackers even reach your computers. Social engineering encompasses a wide range of deceptive moves, including impersonating somebody else, and even seduction. This was probably one of the best talks in the entire conference and it really showed us how the best hackers probably don't even need a computer to get you.

Wireless Security

This is still problematic issue. In Singapore, we're collecting statistics and our current data shows that as much as 50% of home networks are running unsecured wireless components. We are in the midst of collating our data and will be publishing it soon. The speaker did give us a few ideas, as well as corroborate ideas we already had about how wireless networks could be abused. We'll bring you more on this shortly.

Bluetooth viruses

F-Secure had a great demonstration of the current BT Virus technology. Although not many such viruses are known at the moment, there is certainly cause for concern at the potential explosion of such viruses. In a certain way, BT viruses are now in the days similar to the advent of the first widespread PC viruses such as (c) Brain. They could well become something more powerful and with better capability to spread. Thumbs up F-Secure!

VoIP

Many telcos are going into VoIP big time. You telco might be one of them. However, current protocols for VoIP are still immature and not very highly geared on security aspects. This presents the potential problem that businesses which are currently using reliable PSTN networks, and new businesses, who decide to jump onto the VoIP bandwagon, may very well expose themselves to a variety of security problems, including eavesdropping, unauthorized phone calls at company expense, and identity theft.

All in all, it was a very remarkable and good conference and we look forward to being there next year.

Website outage

Website outage: Server crash. We're back online now.

The website was down for around 24 hours due to a failure on one of servers. System looks good now and we will be looking at better preventive measures.

Thank you for your patience and understanding.

PAV Full CD Updater 1.6.5 Released

A minor patched version of PAV Updater for the Full Custom CD has been released. No major change was made except adding of F-Prot Antivirus added into the archieve. A future version is planned for both Lite and Full CD to make use of the F-Prot DOS Scanning as an alternative during the CD bootup.

Cerberus Network visits Hack Off!

ISSA organized Hack Off!, a security event dedicated to the theme of Penetration Testing. Cerberus Network brings you some highlights and thoughts.

ISSA's Hack Off! event was held at the Singapore History Museum Auditorium. It was very well attended and the audience ranged from CIOs and representatives from various government bodies, to the middle management and the technical staff.









The talk was very well balanced, with the speaker, Pure Hacking CEO Robert MacAdam delivering content ranging from the importance of Penetration Testing to how to select a Penetration Testing company. This catered to the wide ranging audience that included CIOs down to technical department representatives. The introduction to how to select a penetration testing company for individual organizations was also a great eye-opener.

What we really liked in particular, was Rob's reply to a question from the audience, that roughly went like "So whats the best defence for our organization?" Rob's answer in one word - Education. Cerberus Network firmly believes that Education of users is the best way to create a safe computing environment for everyone.

It was a pity though that the much touted "Live Hack" demonstration was only a pre recorded video replay of a classic SQL attack on a badly misconfigured SQL server. It would have been a lot more interesting if the hack was indeed done live.

The material used during the talk can be directly downloaded by from this link http://www.issa.org.sg/papers/20050921_ISSA-HackOff.pdf. The ISSA website contains other relevant information about the talk, as well as information about the ISSA and the events they organize.

On an ending note, one very interesting event did happen at the seminar which set us thinking at Cerberus Network. The organizers asked for business cards to be used in the lucky draw, in which a free iPod Shuffle would be given away. The catch was - you had to write your NRIC (Singapore's equivalent of a Social Security Number) on the back of your card or you would be disqualified. With Singaporeans' NRIC being used in so many situations, would this represent a potential security loophole leading to identity theft and would Singaporeans bite the hook?

We'll tell you more about the NRIC in future updates. Till then.

Welcome to Cerberus Network!

This is the new home of Cerberus Network!
We will be moving our old posts into this area and adding in more IT security contents shortly.