Free webinar BackTrack and Kali Linux from CBT Nuggets trainer Keith Barker!

CBT Nuggets will be available webminar 30 minutes free on the BackTrack Linux and Kali.

The reason for this webinar to show the new training series on the BackTrack Linux and Kali.

Have you ever wondered what Kali Linux is, and how it can help you? Find out in a free 30-minute webinar with CBT Nuggets trainer Keith Barker!

Keith, creator of CBT Nuggets' "BackTrack and Kali Linux" training series, will give an overview of these valuable pentesting tools and will answer participants' questions. Don’t miss it!

What: BackTrack & Kali Linux webinar

When: 10 a.m. (Pacific Time), Wednesday, July 17

Register: To register, click here

What is a Denial of Service Attack?

What is a Denial of Service Attack? by

29C3 Cisco Phones Easy Hack

Hacking Cisco Phones

 Just because you are paranoid doesn't mean your phone isn't listening to everything you say

We discuss a set of 0-day kernel vulnerabilities in CNU (Cisco Native Unix), the operating system that powers all Cisco TNP IP phones. We demonstrate the reliable exploitation of all Cisco TNP phones via multiple vulnerabilities found in the CNU kernel. We demonstrate practical covert surveillance using constant, stealthy exfiltration of microphone data via a number of covert channels. We also demonstrate the worm-like propagation of our CNU malware, which can quickly compromise all vulnerable Cisco phones on the network. We discuss the feasibility of our attacks given physical access, internal network access and remote access across the internet. Lastly, we built on last year's presentation by discussing the feasibility of exploiting Cisco phones from compromised HP printers and vice versa.


Cisco PSIRT has assigned CVE Identifier CVE-2012-5445 to this issue.

IP Cisco Phones:

• Cisco Unified IP Phone 7975G
• Cisco Unified IP Phone 7971G-GE
• Cisco Unified IP Phone 7970G
• Cisco Unified IP Phone 7965G
• Cisco Unified IP Phone 7962G
• Cisco Unified IP Phone 7961G
• Cisco Unified IP Phone 7961G-GE
• Cisco Unified IP Phone 7945G
• Cisco Unified IP Phone 7942G
• Cisco Unified IP Phone 7941G
• Cisco Unified IP Phone 7941G-GE
• Cisco Unified IP Phone 7931G
• Cisco Unified IP Phone 7911G
• Cisco Unified IP Phone 7906

Presentation slides:

• Comapct Slides (142 Mb)

<Begin RNE Text>
Symptoms: Cisco Unified IP Phone 7900 series devices also referred to as Cisco TNP Phones contain an input validation vulnerability. A local, authenticated attacker with the ability to place a malicious binary on the phone could leverage this issue to elevate their privileges or take complete control of the device.
The issue is due to a failure to properly validate certain system calls made to the kernel of the device. This failure could allow the attacker to overwrite arbitrary portions of user or kernel space memory.
The following Cisco Unified IP Phone devices are affected: Cisco Unified IP Phone 7975G Cisco Unified IP Phone 7971G-GE Cisco Unified IP Phone 7970G Cisco Unified IP Phone 7965G Cisco Unified IP Phone 7962G Cisco Unified IP Phone 7961G Cisco Unified IP Phone 7961G-GE Cisco Unified IP Phone 7945G Cisco Unified IP Phone 7942G Cisco Unified IP Phone 7941G Cisco Unified IP Phone 7941G-GE Cisco Unified IP Phone 7931G Cisco Unified IP Phone 7911G Cisco Unified IP Phone 7906
The following models have reached end-of-life (EOL) status (for hardware only): Cisco Unified IP Phone 7971G-GE Cisco Unified IP Phone 7970G Cisco Unified IP Phone 7961G Cisco Unified IP Phone 7961G-GE Cisco Unified IP Phone 7941G Cisco Unified IP Phone 7941G-GE Cisco Unified IP Phone 7906
Refer to the following link to determine what product upgrade and substitution options are available: http://www.cisco.com/en/US/products/hw/phones/ps379/prodeolnotices_list.html
Conditions: Cisco Unified IP Phones within the 7900 Series running a version of Cisco IP Phone software prior to 9.3.1-ES10 are affected. The fixed software release is expected to be available for customers mid-to-late November 2012.
Workaround: Restrict SSH and CLI access to trusted users only. Administrators may consider leveraging 802.1x device authentication to prevent unauthorized devices or systems from accessing the voice network.
Further Problem Description: This issue was reported to Cisco PSIRT by Ang Cui of Columbia University. Cisco PSIRT would like to thank Ang and his staff for working with Cisco to resolve this issue.
PSIRT Evaluation: The Cisco PSIRT has assigned this bug the following CVSS version 2 score. The Base and Temporal CVSS scores as of the time of evaluation are 6.8/5.6: https://intellishield.cisco.com/security/alertmanager/cvssCalculator.do?dispatch=1&version=2&vector=AV:L/AC:L/Au:S/C:C/I:C/A:C/E:F/RL:OF/RC:C
CVE ID CVE-2012-5445 has been assigned to document this issue.
Additional information on Cisco's security vulnerability policy can be found at the following URL: http://www.cisco.com/en/US/products/productssecurityvulnerability_policy.html
<End RNE Text>

source:  http://events.ccc.de/congress/2012/Fahrplan/events/5400.en.html

FIX for Oracle Java 7 Security Manager Bypass Vulnerability

Oracle launch  new version of Java for Oracle Java 7 Security Manager Bypass Vulnerability

Systems Affected

Any system using Oracle Java 7 (1.7, 1.7.0) including

• Java Platform Standard Edition 7 (Java SE 7)
• Java SE Development Kit (JDK 7)
• Java SE Runtime Environment (JRE 7)

All versions of Java 7 through update 10 are affected.  Web browsers using the Java 7 plug-in are at high risk.

Overview

A vulnerability in the way Java 7 restricts the permissions of Java applets could allow an attacker to execute arbitrary commands on a vulnerable system.

Description

A vulnerability in the Java Security Manager allows a Java applet to grant itself permission to execute arbitrary code. An attacker could use social engineering techniques to entice a user to visit a link to a website hosting a malicious Java applet. An attacker could also compromise a legitimate web site and upload a malicious Java applet (a "drive-by download" attack).
Any web browser using the Java 7 plug-in is affected. The Java Deployment Toolkit plug-in and Java Web Start can also be used as attack vectors.
Reports indicate this vulnerability is being actively exploited, and exploit code is publicly available.
Further technical details are available in Vulnerability Note VU#625617.

Impact

By convincing a user to load a malicious Java applet or Java Network Launching Protocol (JNLP) file, an attacker could execute arbitrary code on a vulnerable system with the privileges of the Java plug-in process.

Solution

Install new version Java Runtime Environment 7 Update 11.


Source :  http://www.us-cert.gov/cas/techalerts/TA13-010A.html

How to solve solve problems uninstalling and installing WinPcap in Windows 64-bit e

WinPcap is the industry-standard tool for link-layer network access in Windows environments: it allows applications to capture and transmit network packets bypassing the protocol stack, and has additional useful features, including kernel-level packet filtering, a network statistics engine and support for remote packet capture.  (in http://www.winpcap.org/)

WinPcap is used in various applications for diagnostic monitoring. It is usually used in conjunction with other software such as Wireshark.

In 32-bit environments drivers are installed here :  drive\Windows\System32
In 64-bit environments drivers are installed here :  drive\Windows\SysWOW64

The uninstaller automatically uninstalls the normally 32-bit version, not the 64-bit version.

There monitoring applications as the "Messenger Detect 3" that comes included with the x64 Winpcap. And when it does not detect installed if you have installed the x64 Winpcap. Then install.

If you remove the Winpcap only removes 32 bits. Staying with the 64 bits. If you try to reinstall Winpcap, the Winpcap of error because already installed on 64-bit.

To resolve must disable the services used by drivers Winpcap, go drive the folder "drive\Windows\SysWOW64", and then manually remove the drivers.

Only then can re-install successfully Winpcap.

 

What is the best antivirus to analyze traffic Https?

What is the best antivirus to analyze traffic Https?
NSS Labs did a report that analyzes several antivirus. And it interesate know that some are not able to analyze the https traffic. Since this is a secure channel, but nowadays even the https can be compromised with cerificates false.

An example of analyzing the https traffic to detail, is to replace the cerificates, and resign the return traffic. The Wachtguard does just that.

The full report can be downloaded for free.

The report does not include all antivirus.

Just one day after the correction of security breach, there is another even worse ...

From Dan Goodin  [http://arstechnica.com]

Researchers said they've uncovered a flaw in the Java 7 update released by Oracle on Thursday that allows attackers to take complete control of end-user computers.

The flaw in Java 7 Update 7, which Oracle released to stop in-the-wild attacks that silently install malware on end-user machines, is the latest black eye for the security of the widely used software framework. It comes after revelations that Oracle learned of the vulnerabilities under attack in April, four months before the exploits were detected. Oracle has yet to explain the delay in fixing the bugs.

The latest bug "facilitates full Java sandbox bypass on latest Java 7 Update 7," Adam Gowdiak, the CEO of Poland-based Security Explorations, wrote in an e-mail to Ars. His team developed proof-of-concept code and delivered it on Friday to Oracle engineers. The discovery of the new critical bug was reported earlier by IDG News. There are no reports that it is being exploited online.

Java "applets" run in a secure sandbox that prevents them from interacting with sensitive operating-system functions unless authorized.

"The total hunt took about 2-3 hours," Gowdiak wrote. "It was done yesterday in the evening. The discovery was made [as] a result of a manual analysis of Java code (its implementation)."


Gowdiak declined to discuss technical details out of concern that they may make it easier for criminals to exploit the flaw in e-mail- or Web-based attacks. He said the discovery came "while trying to fix the proof-of-concept codes that stopped working after applying the recent Java patch."


An Oracle spokeswoman responding to a request for comment referred Ars to this advisory, which was published with Thursday's update. She and other representatives didn't respond to a follow-up e-mail informing her that the advisory was published before the most recent vulnerability was discovered.


This week's attack, and Oracle's lack of public response to them, has renewed calls by many—this reporter included—to remove Java from computers that don't use the cross-platform framework. Many programs that claim Java is required work fine, or almost as well, without the Oracle software, as confirmed by at least two Ars readers on Thursday. Even when it's mandatory for programs such as Adobe Photoshop, as one Mac-using Ars reader reported, users may want to remove Java plugins from their browsers if the websites they regularly visit don't require it. The removal advice has proved controversial to some, so Ars readers are encouraged to decide for themselves. (Oracle's official Twitter account for Java has also disagreed with the advice.)

Two of some 19 bugs that Gowdiak's firm reported in April were among those combined in the latest proof-of-concept attack to completely bypass the security sandbox Java relies on to ensure untrusted code can't access sensitive operating-system functions. Some of the remaining holes still haven't been plugged, and when linked to the latest discovered flaw, attackers could once again have the ability to escape the safety perimeter.

Said Gowdiak: "When combined with some of the April 2012 issues, the new issue allows [one] to achieve a complete [Java virtual machine] sandbox bypass in the environment of latest Java SE 7 Update 7 (version that was released on August 30, 2012)."

Source: http://arstechnica.com/security/2012/08/critical-bug-discovered-in-newest-java/

Security flaw resolved in versions of Java 7u7 and 6u35

Security Alert for CVE-2012-4681 Released

Oracle has just released Security Alert CVE-2012-4681 to address 3 distinct but related vulnerabilities and one security-in-depth issue affecting Java running in desktop browsers. These vulnerabilities are: CVE-2012-4681, CVE-2012-1682, CVE-2012-3136, and CVE-2012-0547. These vulnerabilities are not applicable to standalone Java desktop applications or Java running on servers, i.e. these vulnerabilities do not affect any Oracle server based software.

Apparently, Oracle knew about the problem for months, and did nothing to resolve it. Who says researchers are security Security Explorations, have warned that indicate the company several months ago.

 The Venturebeat says that the security company has released a list of all the vulnerabilities of the code and sent to Oracle in April. In response, Oracle said it had received the report and that the update should be released in June. However, continue to investigate other problems until August.


To check the version you have installed should re-enable Java in the browser, if the disabled are as indicated, and access Java test page.

Due to the high severity of these vulnerabilities, Oracle recommends that customers apply this Security Alert as soon as possible. Furthermore, note that the technical details of these vulnerabilities are widely available on the Internet and Oracle has received external reports that these vulnerabilities are being actively exploited in the wild.

• Developers should download the latest release at http://www.oracle.com/technetwork/java/javase/downloads/index.html
• Java users should download the latest release of JRE at http://java.com, and of course
• Windows users can take advantage of the Java Automatic Update to get the latest release.

For more information:

• The Advisory for Security Alert CVE-2012-4681 is located at http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html
• Users can verify that they’re running the most recent version of Java by visiting: http://java.com/en/download/installed.jsp
• Instructions on removing older (and less secure) versions of Java can be found at http://java.com/en/download/faq/remove_olderversions.xml

 
I recommend you uninstall all previous versions of Java (JRE and JDK), and install the new versions.

Source: https://blogs.oracle.com/security/entry/security_alert_for_cve_20121