Readings:

Web based attacks are most dangerous environments with numerous ways to compromise Confidentiality, Integrity and Availability. Various methods exist to break into web services, servers and sites components, such as: Phishing XSS, Injections Flaws, Unsecured storage,  Broken Authentication and access controls, Unvalidated data inputs, etc. Especially, SQL Injection is very powerful in hands of hackers since SQL databases are all over the globe in every web site. The best security practices to avoid being a victim of such attacks is to make sure industry standards are followed when designing web based applications.

Question to the Class: Would WebGoat be considered the best up-to-date tool to practice attacks?

In the News:

If you are using a SimpliSafe wireless home alarm system to improve your home security smartly, just throw it up and buy a new one. It is useless.

Read more here:

http://thehackernews.com/2016/02/hack-home-security-alarm.html

Assigned readings:

Burp Suite is a tool that allows security testing of Web applications. This framework is very powerful for if it is used properly, it identifies vulnerabilities and exploits them. This tool is composed of proxy, spider, intruder, repeater, sequencer, decoder and comparer. Burp intruder allows you to customize attacks against any Web applications and it is composed of four elements: target, positions, payloads and options. SQL Injection testing is also another method that is used within the Burp intruder. Burp repeater manually modifies the HTTP requests and tests the responses given by the page. Burp sequencer checks for the extent of randomness in the session tokens generated by the Web application. Burp decoder sends a request to the decoder and lastly, burp comparer compares between two sets of data. Web application vulnerabilities is becoming more sophisticated however they are various methods to prevent such threats and protect the assets of the company. One of the most common methods include web application scanners and firewalls. Also, it is important to note that managers play a significant role when it comes to web application security.

Question for the class:

What are you experiences thus far using Burp Suite?

In the news: “Vulnerability found in two-factor authentication”

Two-factor authentication is a computer security measure used by major online service providers to protect the identify of users in the event of a password loss. Security experts have long endorsed two-factor authentication as an effective safeguard against password attacks. But what if two-factor authentication could be cracked not by computer engineering but by social engineering? A study was conducted with a scenario in which a hacker, armed only with the target’s mobile phone number, attempts to log into a user’s account and claims to forget the password, triggering a verification SMS text. I n a pilot test of twenty mobile phone users, 25 percent forwarded the verification code to an attacker upon request while proving the success of Verification Code Forwarding Attack.

Click here to read more about this article.

“Keybase Releases Encrypted File-Sharin iPhone App”

Keybase last week announced the alpha release of the Keybase app for the iPhone with a cryptographically secure file mount. Users can write data in an automatically created folder in this format: /keybase/public/username. Files written in the folder are signed automatically and appear as plain text files. The folder prevents server-side and man-in-the-middle attacks. Files stream in on demand; there is no syncing as there is in Dropbox, Google Drive and Box.

For more information regarding this article, please click here.

*/ No Reading for this week.

In the News:

National Security Agency merging offensive, defensive hacking operations

The U.S. National Security Agency on Monday outlined a reorganization that will consolidate its spying and domestic cyber-security operations, despite recommendations by a presidential panel that the agency focus solely on espionage.

Read more at: http://www.reuters.com/article/us-usa-cyber-nsa-idUSKCN0VH21H

Advanced Penetration Testing -Week-5

You have been invited to attend a Mediasite presentation.

Presentation Details:
Title: =MIS 5212.001_2/8/2016
Date: Monday, February 8, 2016
Time: 5:30 PM (UTC-05:00) Eastern Time (US & Canada)
Duration: 2:30:00
Link: http://tucapture.fox.temple.edu/Mediasite/Play/838dfd6cce4641f1a38055e70c51733e1d

http://www.securityweek.com/top-reasons-pay-attention-dark-web

Top Reason To Pay Attention To The Dark Web

Tim Layton offers a great perspective regarding content in the Deep Web or as he refers to it “Dark Web”

His inside information breaks down what a new user can expect once Tor is open and simple searches are done throughout the special Firefox browser.

There are good reasons for taking advantage of Dark Web intelligence but we should also explore the challenges of collecting it says Layton but also he offers the other side of the story due to kegal and unknown reasons why not to surf in the dark web.

It looks like I may be confused about what’s expected this week…

Reading: Metasploit Unleashed – MSF Extended Usage and Metasploit GUIs. This weeks’ reading introduced us to a broad range of tools and techniques for working with and extending the Metaploit Framework to conduct and improve penetration testing during pre-exploitation, exploitation, and post-exploitation activities.  I am particularly intrigued by the exploit presented where msfvenom is used to create an EXE file, which when inadvertently run by a user, compromises their Apple computer’s OS X and takes over the camera for unexpected picture taking of the user.

Question for the Class: Which language is Mimikatz using to communicate with the user in the screen and on the command line?

In The News:  “Export Treaty to Get Rewrite in Win for Security Industry”, by Phil Muncaster, Feb. 4, 2016. Good news for white hats this week after US Department of Commerce stepped back from a rule agreed to in the Wassenaar Arrangement among 41 countries to prevent export of dual-use technologies to criminal organizations and repressive regimes.  The Government will now seek public comment on a revised draft rule pertaining to a controversial clause in a weapons export pact which threatens to severely limit the use of legitimate security testing tools for finding software flaws.

http://www.infosecurity-magazine.com/news/export-treaty-get-rewrite-win/

Advanced Penetration Testing -Week-4

You have been invited to attend a Mediasite presentation.

Presentation Details:
Title: =MIS 5212.001_2/1/2016
Date: Monday, February 1, 2016
Time: 5:30 PM (UTC-05:00) Eastern Time (US & Canada)
Duration: 2:30:00
Link: http://tucapture.fox.temple.edu/Mediasite/Play/4b3bfa0cea6740deb3b8621777fa42841d

          Description: