Presentation – Jason Lindsley Scanning Exercise PowerPoint
Executive Summary – Jason Lindsley Scanning Exercise – Executive Summary
ITACS 5211: Introduction to Ethical Hacking
Wade Mackay
Presentation – Jason Lindsley Scanning Exercise PowerPoint
Executive Summary – Jason Lindsley Scanning Exercise – Executive Summary
Hello, the links to the executive summary, powerpoint slides, and video are below. If there are any issues, please let me know. Thanks.
This article is about a flaw in iOS 10 which allows the execution of malicious code if your view a JPEG, font files or PDF file through a website or email. The good news is that Apple has released iOS 10.1 to correct this issue. In fact, the iOS 10.1 update addresses 11 security flaws.
This announcement is fresh of the heels of a DD0S attack last week that used some non-conventional technologies such as cameras, routers and DVR’s to perform that attack. It’s only a matter of time before hackers turn to other avenues to perform their attacks as other avenues are closed off. Everyone thinks phones, cameras, etc are safe from this, but the truth is, anything that is connected to the Internet can, and most likely will, be a target for hackers.
Recently, researchers have demonstrated that how attackers can cause fatal equipment failures by destroying the integrity of 3D-printed parts. In a proof-of-concept experiment, they sabotaged the 3D printed replacement propeller of a quadcopter by maliciously modifying its design, and thus caused the quadcopter to fall from the sky. Researchers simulated how attackers could use spear phishing emails to obtain access to the target controller PC for 3D printing, and install malwares on the target. The malware then downloaded the blueprint, and replaced the original blueprint with the one with developed sabotaged design. In the experiment, researchers modified the design file by inserting 0.1mm internal rectangular gaps into the joint, and the sabotage would remain unnoticed by a simple visual inspection. The propeller performed normally in the first three test cycles, but broke apart in the fourth cycle. This experiment is designed to expose the threat additive manufacturing companies face from increasing use of 3D printing. There are increasing industries started to use 3D printed parts in their products, such as aerospace and automotive industries. The growth of additive manufacture also attracts attention of hackers from criminal gangs or terrorists.
One thing I think interesting is that the design defect could not be noticed through visual inspections, and the quadcopter could even normally perform in the initial test. This would be very dangerous if this kind of attack happens in the real life. For example, if the 3D printing blueprint of a replacement part of an airplane is maliciously modified, the airplane may be still able to pass the visual inspection and flight mechanical test. However, the unnoticed defect may lead to airplane failures or even air crash later in real flight. In addition, I think this kind of attacks can hardly be conducted by an individual, because it requires both IT experts and experts with knowledge and experiences in the targeted industry. Therefore, this kind of attacks may attract more attention of terrorist organizations with adequate resources rather than normal hackers. This would become a great threat to governments, since many countries have already used 3D printing for weapon and aircraft manufacturing.
There has been another recent wide-scale DDoS attack, this time against Dyn DNS service. This company provides DNS service to Twitter, Etsy, GitHub, Souncloud, PagerDuty, Spotify, Shopify, Airbnb, Intercom and Heroku. All the listed sites were affected. It looks like the DDoS attack was launched used IoT devices, which was similar to the attack on the Krebs site a month ago. I wonder if we will start seeing more of these attacks on DNS service providers, instead of specific websites.
Article: http://www.securityweek.com/twitter-others-disrupted-ddos-attack-dyn-dns-service
This article discusses the details around the distributed denial-of-service (DDoS) attack that occurred on Friday morning using a large number of Internet of Things devices such as webcams, DVRs, and other smart devices that have minimal security features. Attackers were able to successfully impact the DNS provider Dyn for several hours while interrupting many large sites such as Amazon and Twitter. The attack is being labeled as an easy and non-sophisticated attack using simple devices and easily attainable malware.
The attackers used a botnet program called Mirai to gain control of all these devices. Mirai uses simple telnet commands to search for available devices and cycles through default login information until it is able to successfully gain access. Unlike normal servers, a majority of the IoT devices broadcast their version and model number once you connect to them.
With a large volume of IoT connected devices being added everyday, it raises the new concern of the lack of security in IoT devices. As showed on Friday, we now have to be concerned with a relativity easy attack that criminals can use to disrupt the internet.
http://www.darkreading.com/vulnerabilities—threats/root-of-more-iot-based-ddos-attacks/d/d-id/1327281?
We’ve talked briefly at MD5 collision in the last class, and some people has some questions about it. The two links provided below; the first is explaining what MD5 collision is and the second will let you create your own collision.
Basically, collision occurs when two completely different files have the same digest. When you use a hash algorithm: 1st you take the original message (plaintext), add some padding, run it through the hash algorithm (in this case MD5), and then it returns a message digest (ciphertext). Each file, if not exactly the same, should have a different digest. Nat McHugh has found a way to add prefixes to the plaintext (files: jpg, txt, etc) that would make the hash algorithm return the same hash even if the files were different.
He has created a Amazon Web Service (AWS) image that would allow you to download and run the script for about 7 cents an hour. I’ve tried it and it took about a day to create a collision. So I was able to create a MD5 collision for less than 2 bucks. If you are interested you can try it out:
http://natmchugh.blogspot.com/2015/09/md5-collisions-in-ssh-keys.html
http://natmchugh.blogspot.com/2015/02/create-your-own-md5-collisions.html
Since we were on the subject of social engineering of last weeks class. I thought this was an interesting article dealing with the university that we all attend. This is a case of a student using her Target gift card to get pass security. The student acted like she belonged and she was able to not get security to really look to see if she had an ID, which is needed to get in most of the buildings on campus.
Read article here
Increased social media usage means personal information is more exposed than ever before. Fraudsters can leverage this to enable better social engineering attacks. However, employees can protect themselves. First, if employees use strong passwords on their social media sites, the threat of social engineering attacks is reduced. Additionally, 60% of employee social media profiles are completely public meaning anyone can see their content. If employees make their accounts private the threat of social engineering is reduced even further. Other approaches that can help are making sure that employees are well educated about the risk of making their information private and the threat of social engineering. Finally, in order to provide employees with a safety net, companies should implement safeguards so that if employees do fall prey to social engineering it doesn’t lead to an organization wide data breach.