Sunday, March 24, 2013
How to bypass iOS 6.1.2 Screen Lock,Another EXploi7 exposed
How to bypass iOS 6.1.2 Screen Lock, another Exploit Exposed
Hackers found an iOS 6 bug
two weeks ago that allowed thieves into your phone, but only the Phone
app and the features contained within could be accessed. Just after
that, recently another screen lock bypass vulnerability reported in iOS 6.1 by Vulnerability Lab.
This vulnerability allows users to bypass the lock screen pass code and
access the phones photos and contacts. Researchers say the vulnerable
device can be plugged into a computer via USB and access data like voice
mails, pictures, contacts, etc.
This particular vulnerability was shared in detail over in a YouTube video for the masses, you can see the video tutorial as shown below:
Steps to Follow:
- Connect your device with itunes and the appstore to make sure the code lock is activated
- Push the power button (top|right)
- The mobile will be activated and the iOS code lock will be visible
- Now, you click on the emergency call
- Try to dail any random emergency call number from a public listing (we used 911, 110 and 112)
- Call the number and cancel the call directly after the dail without a direct connection to the number
- Push again the power button and push after it the iphone button (square) in the middle
- In the next step you push the power button 3 secounds and in the third secound you push also with one finger the
- square and with another the emergency call button
- After pushing all 3 buttons you turn your finger of the square (middle) button and after it of the power button
- The display of the iOS will be black (blackscreen)
- Take our your usb plug and connect it with the iOS device in black screen mode
- All files like photos, contacts and co. will be available directly from the device harddrive without the pin to access.
Note : There is a limitation in this method also, that is
actually not mentioned by hackers. The file system of iOS is in
encrypted form. So, when your pass code protected iPhone
is connected to a new computer, it must first be unlocked before it can
be accessed by the computer. Smooth way connectivity is only possible
only if the computer used to gain access to your file system has been
successfully connected to your iPhone before.
It's not clear if the company is aware of this second flaw or if a fix for it is also inbound.
Gaming Platforms as an attack vector against remote systems
Little more than a year ago I wrote about the possibility to attack gaming platform
to compromise large audience of gamers in stealthy way, the access to
millions of machines represent a dream for every attackers and I
hypnotized its repercussion in cyber warfare domains. Gaming platform
are usually complex systems equipped with the latest technology and the
idea to exploit them as possible attack vectors cultivated by many
governments.
Researchers at ReVuln, Luigi Auriemma and Donato Ferrante, presented at Black Hat Europe 2013 in
Amsterdam how to convert local bugs and features in remotely
exploitable security vulnerabilities by using the popular EA Origin 3
platform as an attack vector against remote systems.
EA Origin is one of the biggest gaming related digital delivery platforms with more than 40 million the access it to purchase games for any kind of platform, from mobile to PC.
Before describe the discovery of the two Italian experts let's give analyze how games run under Origin platform, game execution articulated in the following steps that allows the DRM protection
As shown in the picture Origin process communicates with games via a specific formatted URI, origin://, Origin also allows games upon launch to use custom command line arguments, CommandParams, specified as URI parameter.
The Paper states:
"The Origin platform allows malicious users to exploit local vulnerabilities or features, by abusing the Origin URI handling mechanism. In other words, an attacker can craft a malicious internet link to execute malicious code remotely on victim's system, which has Origin installed."
ReVuln Team demonstrated attack scheme using the game Crysis 3 recently released and proving several ways to trigger execution of remote code, the results are surprising, an attacker could execute malicious code to hit remote victim systems abusing the Origin platform.
One of the methods exploits a feature in the NVidia Benchmark framework in CryEngine's game engine using a specially craft Origin link, the attacker in this case only need Origin game ID of the victim for the attack.
A proof of concept is available on Vimeo Revuln Channel:
EA Origin is one of the biggest gaming related digital delivery platforms with more than 40 million the access it to purchase games for any kind of platform, from mobile to PC.
Before describe the discovery of the two Italian experts let's give analyze how games run under Origin platform, game execution articulated in the following steps that allows the DRM protection
- S1. The game invokes Origin by providing possible command line arguments to the Origin process.
- S2. The game process dies.
- S3. The Origin process spawns the actual game by providing the same command line arguments provided in S1.
As shown in the picture Origin process communicates with games via a specific formatted URI, origin://, Origin also allows games upon launch to use custom command line arguments, CommandParams, specified as URI parameter.
The Paper states:
"The Origin platform allows malicious users to exploit local vulnerabilities or features, by abusing the Origin URI handling mechanism. In other words, an attacker can craft a malicious internet link to execute malicious code remotely on victim's system, which has Origin installed."
ReVuln Team demonstrated attack scheme using the game Crysis 3 recently released and proving several ways to trigger execution of remote code, the results are surprising, an attacker could execute malicious code to hit remote victim systems abusing the Origin platform.
One of the methods exploits a feature in the NVidia Benchmark framework in CryEngine's game engine using a specially craft Origin link, the attacker in this case only need Origin game ID of the victim for the attack.
The researchers demonstrated that it is possible to conduct same attack
also in the case attackers haven't any knowledge of the specific games
installed on the remote system itself, the paper describes the
technique named "No-look exploitation link" with following statements
"An attacker can brute-force the Game ID field in the URI in order to find a vulnerable game installed on the victim's system. The idea is pretty straightforward, once an attacker finds a set of vulnerable games sharing the same vulnerable game engine, an attacker can define the following link:"
Auriemma Ferrante and not merely describe the way exploit
vulnerabilities but provide also suggestions to mitigate the threat such
as disabling the origin:// URI globally or the origin:// handler in the users' browsers which supports such feature.
Let me suggest to give a look to the presentation proposed by ReVuln, I found many points of interest such as the reference to a 0-day vulnerability market specific for gaming platforms. The demand for this kind of 0-days increased, on the market is possible acquire both server-side and client-side exploit and also rent services such as DDoS attacks against clients or servers.
It easy to predict that in the future we will assist to an increase of this type of attacks with unpredictable consequences, while the technological component in our lives is becoming increasingly significant, in parallel increases our attack surface.
"An attacker can brute-force the Game ID field in the URI in order to find a vulnerable game installed on the victim's system. The idea is pretty straightforward, once an attacker finds a set of vulnerable games sharing the same vulnerable game engine, an attacker can define the following link:"
Let me suggest to give a look to the presentation proposed by ReVuln, I found many points of interest such as the reference to a 0-day vulnerability market specific for gaming platforms. The demand for this kind of 0-days increased, on the market is possible acquire both server-side and client-side exploit and also rent services such as DDoS attacks against clients or servers.
It easy to predict that in the future we will assist to an increase of this type of attacks with unpredictable consequences, while the technological component in our lives is becoming increasingly significant, in parallel increases our attack surface.
BBC Twitter Account Hacked By Syrian Electronic Army
HDFC Bank website Vulnerable to ID Theft and Account Blackade
Indian Security Researcher Jiten Jain today revealed that
one of the Largest Private Banks in India, HDFC Bank’s e-Banking
website could be easy target of Unique type of Denial of Service
Attack which could result in blocking of e-banking accounts of all its
customers. Here is the detailed report of vulnerability submitted by
him.
___________________________________________
The NetBanking service of HDFC Bank, Which is one of the largest and
most reputed Banks in India, is completely vulnerable to ID theft,
Targeted phishing and Mass Account Blockade. HDFC bank has implemented
an extra security solution called 'Secure Access' on its website but
instead it has given a hidden door to hackers to block all HDFC
NetBanking accounts. 'Secure Access' is an additional layer of security
implement on HDFC Bank website is essentially a solution protecting your
account from hackers and fraudsters. Secure Access, an online security
initiative is intended to make NetBanking transactions safer by
protecting users from phishing websites and Hackers and help users
authenticate original HDFC website. HDFC Bank's NetBanking login is now a
two-step process with Secure Access image and text verification. Let us
take you through the steps involved in Secure Access and how it intends
to protect NetBanking account of HDFC customers.
Let us take you through the steps involved in Secure Access and how it intends to protect NetBanking account of HDFC customers.
1) In First Step User has to provide his customer-id (User Id) on the first screen
 |
| Image Protected By Devilz-Code.blogspot.com |
2) User is then taken to the next screen where he is shown his
personalized picture and message and asked to enter his IPIN (password).
Demo presentation of secure access work can be seen on HDFC website at following URL http://www.hdfcbank.com/assets/demo/secure_access.swf
Secure Access which is claimed to be Multi-layered Authentication
Process mandatory requires HDFC NetBanking users to register for it if
they want to conduct ANY Third Party Transactions like Transferring
Money, booking movie tickers, recharging phone.
During the research on HDFC Mobile Banking application and NetBanking
Portal it was discovered that while implementing Secure Access HDFC Bank
has compromised on the first and foremost principle of user
authentication on any Banking website i.e. Never reveal whether its User Name or the password which is incorrect in case wrong combination is entered.
Since Secure access implementation requires user to only enter his Customer ID (The fixed user name in case of HDFC bank NetBanking users. The system then checks at the backend if the user is registered for Secure Access or NetBanking, if user is not a registered or valid user, Customer id is asked again. But in case if the customer id is found to be correct and registered, User is taken to second step and shown his secure access image and text he selected and asked to enter is password.
Since Secure access implementation requires user to only enter his Customer ID (The fixed user name in case of HDFC bank NetBanking users. The system then checks at the backend if the user is registered for Secure Access or NetBanking, if user is not a registered or valid user, Customer id is asked again. But in case if the customer id is found to be correct and registered, User is taken to second step and shown his secure access image and text he selected and asked to enter is password.
1.) 1 Now this 1st step of verifying customer id and showing
personalized secure access image and text has made HDFC Bank vulnerable
to Blind customer id collection. We exploited this vulnerability by
running an automated suite with by generating random customer ids in a
sequence (example from 434XXXX to 515XXXXXX) and logged on HDFC
NetBanking website using them. The customer ids which showed secure
access and image and text were noted and rest was discarded. The secure
Access images and text which was shown for valid customer ids were also
saved. Now by the process above we were able to achieve 3 things. It was
shocking to see that secure text was displayed as simple text and not a
text image.
By this automated first step of Login, we were able to create a Database of several customer Ids of HDFC NetBanking users. We
could have made a complete database of every NetBanking users but since
this trial was conducted with a motive of checking security on banking
site, only a sample data was collected. We decided to destroy this data
later after completing this Demonstration.
 |
| Image Protected By Devilz-Code.blogspot.com |
 |
| Customer Id, Personalized Image and Text of Customer in above Screenshots has been hidden for security |
2) We then setup a phishing portal for HDFC Net banking and
created a fake HDFC NetBanking Mobile app and tried it on some people.
In our fake HDFC mobile application and phishing portal we were able to
replicate exactly same Secure Access behavior like on original HDFC
website using the database of Customer IDs of NetBanking users and their
secure Access image and text we had created earlier. Since our site was
showing the same secure Access images and text on entering customer ids
we used their security feature to provide more authentic look to our
phishing website and Mobile application. The Situation was worse for
fake mobile app since Mobile users could not even see the URL, setting
aside any chance of doubt in mind of user. Several users trusted our
phishing site and mobile app and tried to log in with their passwords.
3) Now in a third Killing step we launched denial of service
attack on website the by blocking some user accounts. Since Secure
Access authentication vulnerability has helped us create the database of
customer ids of HDFC NetBanking users we launched another program which
simple went on HDFC NetBanking website and provided customer id from
our database on HDFC NetBanking login page.
As we were providing valid Customer Id's, when asked for IPIN/Password we entered it incorrectly 5 times which resulted in those customers being blocked from NetBanking. We used chain proxy to bypass time and Sequence checks but were surprised to find out that HDFC site had NONE and we were able to easily block several user accounts.
As we were providing valid Customer Id's, when asked for IPIN/Password we entered it incorrectly 5 times which resulted in those customers being blocked from NetBanking. We used chain proxy to bypass time and Sequence checks but were surprised to find out that HDFC site had NONE and we were able to easily block several user accounts.
Since we were guided by ideology of ethical hacking we conducted above
research on a sample data But This flaw in authentication can be easily
used by anyone to generate a Database of Customer Ids of HDFC NetBanking
Users and completely Block all NetBanking accounts of all HDFC
NetBanking users. The same may be the used by the miscreants or
competitors of HDFC bank to hold literally entire NetBanking service of
HDFC bank for ransom by repeatedly blocking accounts even if they are
enabled again. This vulnerability also raises a big question, Are We
forgetting basic principles of Security in race of trying security
solution?
x--x--x
While Speaking to “The Hacker News” ,Mr. Jiten disclosed
that had shared the above vulnerability report with the HDFC Bank in
February itself to provide them ample time to fix the above
vulnerability. The report about lacking security on HDFC online banking
website is another blow to HDFC Bank which is already facing flak for
its shady deals and is currently under a Black Money investigation by
Indian Government.
Canonical to create UbuntuKylin OS for Chinese Users
Canonical, the software company that manages and funds Ubuntu, announced
to develop a new, open-source operating system customized especially
for Chinese users called 'UbuntuKylin OS'.
According to the BBC, Chinese government and Canonical partner to launch
its home grown operating system. China signaled its intention to move
away from its dependence on western software products i.e windows.
Canonical staff and Chinese researchers will be working on the OS at a
Beijing lab. China's Ministry of Industry and Information Technology
will collaborate with Canonical to come up with Kylin to run on servers,
aimed at websites, online shops, and hosting.
The first version of Ubuntu Kylin
is for the laptops and desktops. Therefore the Android dominates the
Chinese market for a few more years. The Ubuntu Kylin is not for the
mobile device because Canonical already has the Ubuntu Mobile OS.
Future releases will also include integration with Baidu maps and
shopping service Taobao, payment processing for Chinese banks, and
real-time train and flight information. WPS Office, known outside China
as Kingsoft Office or KSOffice may eventually land in Ubuntu Kylin as
the default productivity suite.
The first Ubuntu Kylin release for Chinese users is expected next month with 13.04. You can like our Facebook page or follow us on Twitter or add us to your circle in Google + so that you won’t miss out any breaking Hacking news.
Saturday, March 23, 2013
Friday, March 22, 2013
Subscribe to:
Posts (Atom)