The RedHat Network

This week I was asked to upgrade RedHat Enterprise server for a customer. I personally use Ubuntu, and not being part of my company's linux group, it was totally new to me. The reason I blog about this is not because it was technically challenging but it took me quite some effort to figure out how it worked.

When you order a license at RedHat, you need to provide an e-mail address. In my case this was the one of the CIO of my customer. The next thing that happens is that the reseller (my company) receives an e-mail with the confirmation of the purchase and the customer receives an email with a link.

It is very important that the customer clicks this link and fills out the form. During this registration he must choose a customer name and password. Once the account is created you have to run the rhn_register command as root.

This takes you through a script where your server connects to the RHN asks for your customer name and password and gathers information about your system. Once your system is registered you can use the yum package manager to actually upgrade the system.

Bleachbit

Today I discovered the existance of bleachbit. Bleachbit is a nifty little tool that helps you clean up personal info in linux.

BruCon2010

This weekend it was BruCon again :) and just like last year it was a very nice con.

The first talk I went to see was the keynote "Memoirs of a Data Security Street Fighter" by Mikko Hypponen. I saw Mikko presenting at OWASP this year and I was not so happy about that presentation but this one was much better.

Next talk I went to see was "You Spent All That Money And You Still Got Owned..." by Joseph McCray. I went to see this talk before and it was worth watching it for a second time. Joe explains the things in a very comprehensive way. The talk was a little different and I personally liked it, not that it was better, but it was just a slightly different angle to explain it. But bottom line is still to quote him "fix your shit".

I went to a workshop by Didier Stevens. It was of course about pdf and he took us at a very nice tempo through a bunch of pdf's he prepared on a BackTrack4 VM. Bit by bit we learned to analyze them with the tools (pdfid and pdf-parser) he wrote. If you like to read about this, after BruCon he published a document about this on his blog.

In the afternoon I went to see Cyber[Crime|War] by Ian Amit. It was not a technical talk but it made you think, and I liked it.

Then it was Paul Asadoorian aka Paul from Pauldotcom his turn. I was eager to see his talk about Embedded System Hacking and his plot to take over the world. I've been listening to the Pauldotcom podcast from the very beginning and even in his presentation the world famous 'Bob' stories where present :). The content of the presentation was not that new if you listen to the podcast but still it was cool. Besides giving this presentation Paul also gave a nice presentation during the powerpoint karaoke (a game where you present a random deck of slides you have never seen before in you life).

There was a second workshop I took and that was Damn Vulnerable Web App by Ryan Dewhurst and ethicalhack3r. A nice way to get you in touch with all security problems of a web app. Personally, I think that it should become part of any school training where you make a website.

The last talk I went to see is Chris Nickerson's "top 5 ways to steal the company". I knew Chris from the Pauldotcom podcast. Chris is absolutely correct that companies don't care about how you can own their boxes. Management doesn't understand our technical mumbo-jambo and unless we are not changing our ways of presenting them what it means they will never listen to you.

The best lightning talk I saw was the one by Wicked Clown. Not only just for his cool leather jacket (with the image of a wicked clown on it), but also the RDP vulnerability he demonstrated.

Chris John Riley's totally pimped up his presentation about a tool he wrote in Python called UA-tester. Although his 5 minutes where up, it was amazing to see the difference in results switching between user agents. Something to definitely play around with.

Thanks to everybody involved, it was great.

Google Safebrowsing Webtest

Ever wondered how to check if a website has a record for being infected? Well Google can help you. When they scan the Internet for websites they scan also for malware. When you type in your browser:

http://google.com/safebrowsing/diagnostic?site=/

You will get a page back with how many pages where scanned and how much malware it found.

For facebook.com I got these results:

Of the 131,557 pages we have in the past 90 days on the site have been tested, have 31 page (s) without user consent malicious software downloaded and installed. The last time Google visited this site was on 08/08/2010. The last time suspicious content was found on this site was on 08/08/2010. Malicious software includes 132 scripting exploit (s), 3 trojan (s), 2 exploit (s)

It also mentions a bunch of domains like abeermahmoud.jeeran.com, albetaqa.jeeran.com, imageshack.us, rmooosh.net, textstream.co.za, freedesignlogo.com, and a bunch of URLs like facebook.com/dogswxeunck, facebook.com/pages/samra-iraq/imam-medhi-/85996831974/, and pdashmedia.com

I personally think it might be a good idea to have a look at which domains your users are going to, look it up and use this information to filter out the bad stuff.

Get a website as a pdf

http://pdfmyurl.com/ turns your url into a pdf.

Bit.ly url - show the real deal

This week I've found out through a post in one of my RSS feeds how to figure out what url is behind a bit.ly url. You've probably seen them, short urls going bit.ly/somehash. You can figure it out by just adding a + after the hash.

When you do this you get a an overview of the number of clicks, when they where clicked, who tweeted about it, wan where the people are from who clicked on it.

We all know that this service has been abused for spreading malware, but I see this info come in handy for a social engineering purpose.

Welcome to big hotel

I recently had to visit the office of a customer just outside of Brussels. I knew approximatly where it was. Since I didn't get any GPS signal, I had to ask for directions and I stopped at a hotel near by my destination just to ask for final directions.

The hotel where I stopped is part of a big international chain. I walked up to the front desk where a lovely young lady called Marielle (Dutch accent, the ring on her left hand on the ring finger indicated that she is most probably married) according to her name tag greeted me. I explained my problem. She didn't knew where my customer was located so I social engineered her by simply asking if she had Internet access on her computer and if she had access to a website like Google maps. While she was typing I noticed that on every screen in the left corner there was a post-it with the magic words user: username, password: password.

Suddenly my mind started working in a different way and just for fun I asked if I could come behind the desk to have a look at the Google map and by looking at the screen I noticed that it was an Internet Explorer.

So lets have a look at what we got:
- a name for name dropping
- a target who is susceptible to social engineering
- a browser, which has a good track record of being vulnerable
- a user name and password for something which will be most probably the application for managing the rooms

To say it with the words of Louis Armstrong ... What a wonderful world.